{ "openapi": "3.0.1", "info": { "title": "DigiCert® Account Manager REST API", "description": "\nWelcome to the DigiCert® Account Manager API reference documentation! The DigiCert® Account Manager API provides operations for managing DigiCert ONE users and accounts.\n\n## Base URL\n\nThe base URL path for endpoints in the DigiCert® Account Manager API is: `{server}/account`.\n\nReplace `{server}` with the hostname of your DigiCert ONE instance. For example, if you are using the hosted version of DigiCert ONE, your `{server}` is `https://one.digicert.com`.\n\n## Authentication\n\nAPI clients can authenticate to endpoints in the DigiCert® Account Manager API using these methods:\n* Header-based API token authentication\n* Authentication using a client authentication certificate\n\n### API token\n\nTo authenticate with an API token, include the custom HTTP header `x‑api‑key` in your request. Use one of these values in the `x-api-key` header:\n* API token belonging to a DigiCert ONE administrator\n* Service user token ID\n\n**Administrator API token**:\n* Standard users (administrators) can create API tokens for themselves.\n* API tokens have the same permissions and access scope as the administrator that creates them.\n* Actions linked to the API token are logged under the administrator's username.\n* Learn how to generate an API token: [Add and manage API tokens](https://docs.digicert.com/en/digicert-one/account-manager/api-tokens.html)\n\n**Service user token ID**\n* Service users are nonuser-related API tokens that don't belong to or inherit a specific user's permissions.\n* When you create a service user, you assign only the permission needed for the API integration.\n* There are two ways to create a new service user:\n * Use the DigiCert® Account Manager console. Learn more: [Service users](https://docs.digicert.com/en/digicert-one/account-manager/service-users.html)\n * Use the POST `/account/api/v1/user` endpoint in the DigiCert® Account Manager API.\n\n### Client authentication certificate\n\nWhen authenticating with a client authentication certificate, you present a trusted certificate in your request instead of using an API token. DigiCert ONE administrators and service users can both use client authentication certificates.\n\nTo use a client authentication certificate:\n\n* Include the certificate in your API request.\n* In the base URL for the endpoint path, add the prefix `clientauth`. For example: `https://clientauth.one.digicert.com`\n* Omit the `x-api-key` header.\n\n## Requests\n\nThe DigiCert® Account Manager API accepts REST calls on the default ports 80/443. All requests are submitted using RESTful URLs and REST features, including header-based authentication and JSON request types. The data character set encoding for requests is UTF-8.\n\nA well-formed request uses port 443 and specifies the user-agent and content-length HTTP headers. Each request consists of a method and an endpoint. Some requests also include a body if relevant to the operation being performed.\n\n### Method\n\nThe DigiCert® Account Manager API uses these standard HTTP methods:\n\n* GET\n* POST\n* PUT\n* DELETE\n\n### Body and content type\n\nAll requests that accept a body require passing in JSON formatted data with the `Content-Type` header set to `application/json`.\n\nGET requests do not require passing formatted data in the request payload. However, some GET operations allow you to filter the results by providing additional path parameters or URL query strings.\n\n## Responses\n\nEach response consists of a header and a body. The body is formatted based on the content type requested in the `Accept` header.\n\n**Note:** The DigiCert® Account Manager API only supports responses with a content type of `application/json`. Requests that use the `Accept` header to specify a different content type will fail.\n\n### Headers\n\nEach response includes a header with a response code based on [RFC 2616](https://www.w3.org/Protocols/rfc2616/rfc2616-sec6.html#sec6.1.1) specifications.\n\n* HTTP codes in the **200-399** range describe a successful request. Response bodies for HTTP codes in this range include the response data associated with the operation.\n* HTTP codes in the **400+** range describe an error.\n\nUnsuccessful requests return a list with one or more `errors`. Each error object includes a `code` and a `message` describing the problem with the request.\n\n**Example error response**\n\n```JSON\n{\n \"errors\": [\n {\n \"code\": \"duplicate_error\",\n \"message\": \"Nickname api_service_user_3 already exists. Enter a different nickname.\"\n }\n ]\n}\n```\n", "version": "0.1" }, "security": [ { "ApiKeyAuth": [] } ], "servers": [ { "url": "https://{host}", "variables": { "host": { "default": "one.digicert.com" } } } ], "tags": [ { "name": "Accounts", "description": "View, create, and update accounts." }, { "name": "API keys", "description": "View, create, update and delete API Key." }, { "name": "Audit logs", "description": "View audit logs" }, { "name": "Client authentication certificates", "description": "Create, enable, and disable client authentication certificates." }, { "name": "Locales", "description": "View supported locales." }, { "name": "Organizations", "description": "View organization details." }, { "name": "Users", "description": "View users and create service users." }, { "name": "User roles", "description": "View user roles" } ], "components": { "securitySchemes": { "ApiKeyAuth": { "type": "apiKey", "in": "header", "name": "X-API-Key" } }, "schemas": { "AccountOauthClientResponse": { "type": "object", "properties": { "id": { "type": "string", "description": "OAuth integration ID.", "example": "id" }, "name": { "type": "string", "description": "OAuth client name.", "example": "name" }, "status": { "type": "string", "description": "Whether the client is enabled or disabled.", "enum": [ "ENABLED", "DISABLED" ] }, "oauthClientId": { "type": "string", "description": "OAuth client ID.", "example": "client_id" }, "oauthClientAccountId": { "type": "string", "description": "OAuth client account ID.", "example": "client_account_id" } } }, "AccountResponse": { "type": "object", "properties": { "id": { "type": "string", "description": "Account ID.", "format": "uuid", "example": "d2a3814a-225c-4a54-88c3-f4695d3eac0c" }, "name": { "type": "string", "example": "Example account", "description": "Account name." }, "active": { "type": "boolean", "example": true, "description": "If true, account is active. Otherwise, false." }, "service_period": { "type": "object", "description": "Object with service period details.", "properties": { "from": { "type": "string", "description": "Account service period start date. Format: `YYYY-MM-DD`\n", "example": "2021-05-25", "format": "date" }, "to": { "type": "string", "description": "Account service period end date. Format: `YYYY-MM-DD`\n", "example": "2022-05-25", "format": "date" } } }, "friendly_identifier": { "type": "string", "example": 5258283, "description": "Unique friendly identifier for the account." }, "admins": { "type": "array", "description": "List of objects with details about administrators for the account.", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Administrator user ID.", "example": "bdb16aed-27f1-41f7-8138-b9109eb7c0f5" }, "name": { "type": "string", "description": "Administrator name." }, "email": { "type": "string", "description": "Administrator email address." } } } }, "auth_config": { "type": "array", "description": "List of account authentication configuration entries.", "items": { "$ref": "#/components/schemas/AuthConfigDto" } }, "sign_in_methods": { "type": "array", "description": "List of objects with details about sign in methods for the account.", "items": { "$ref": "#/components/schemas/SignInMethods" } }, "oauth_clients": { "description": "List of objects with details about OAuth client integrations for the account.", "type": "array", "items": { "$ref": "#/components/schemas/AccountOauthClientResponse" } }, "locale": { "type": "string", "example": "en_US", "description": "Account locale. One of the locales returned by the /locales endpoint." }, "type": { "type": "string", "description": "Account type.", "example": "standard", "enum": [ "standard", "partner" ] }, "federated_account_id": { "type": "string", "description": "Federated account ID. Present when the account is linked to a federated identity provider.", "format": "uuid", "example": "6c1188f3-3b09-4bd1-b54b-0f6fc011444c" }, "packages": { "type": "array", "description": "List of packages assigned to the account.", "items": { "type": "object", "properties": { "package_code": { "type": "string", "description": "Package code.", "example": "BASE" }, "application_code": { "type": "string", "description": "Application code.", "example": "DAM" } } } } } }, "Application": { "type": "object", "description": "List of objects with application details.\n\n**Note**: Application objects only return the `app_name`, `app_code`, `optional`, `icon`, `url`, and `context` properties when you submit a request to the GET `{base_url}/account/api/v1/user/me` API.\n", "properties": { "id": { "type": "string", "description": "Application ID.", "format": "uuid", "example": "c0494f34-d6f9-478e-ba40-226154719526" }, "name": { "type": "string", "description": "Application name.", "example": "Account Manager" }, "app_code": { "type": "string", "description": "Application code.", "example": "enterprise_manager", "enum": [ "account_manager", "ca_manager", "device_manager", "enterprise_manager", "secure_software_manager", "document_signing_manager" ] }, "optional": { "type": "boolean", "example": false, "description": "If true, the application is optional in DigiCert ONE deployments. Optional applications are only deployed on demand. Otherwise, false." }, "app_name": { "type": "string", "description": "Application name.", "example": "Trust Lifecycle", "enum": [ "Account", "CA", "Trust Lifecycle", "IOT Trust", "Software Trust", "Document Trust" ] }, "icon": { "type": "string", "description": "Application icon.", "example": "tlIcon" }, "url": { "type": "string", "description": "Application URL.", "example": "/mpki/dashboard" }, "context": { "type": "string", "description": "Application context.", "example": "/mpki" }, "short_app_code": { "type": "string", "description": "Short application code.", "example": "tlm" }, "permissions": { "type": "array", "description": "List of permissions enabled for the user.", "items": { "type": "string" }, "example": [ "REVOKE_EM_CERTIFICATE", "RENEW_EM_CERTIFICATE", "VIEW_EM_AUDIT_LOG", "CREATE_EM_CERTIFICATE" ] }, "roles": { "type": "array", "description": "List of roles assigned to the user.", "items": { "type": "string" }, "example": [ "AM_ACCOUNT_ADMIN" ] } } }, "AuditLogEntry": { "type": "object", "properties": { "id": { "type": "string", "description": "Audit log entry ID.\n", "format": "uuid", "example": "90edebb0-e706-4d09-bdfc-1b6a5917e7c5" }, "account": { "type": "object", "description": "Name and ID of account associated with the audit log entry.\n", "properties": { "id": { "type": "string", "format": "uuid", "description": "Account ID.", "example": "88dd63d3-af43-4517-8222-70511968aed8" }, "name": { "type": "string", "description": "Account name.", "example": "Example Account" } } }, "resource_type": { "type": "string", "description": "Type of resource affected by the `action` in the audit log entry. \n", "example": "user" }, "resource_id": { "type": "string", "description": "ID of the resource affected by the `action` in the audit log entry.\n", "format": "uuid", "example": "62646824-9462-42f2-b061-c43bb6f19cf3" }, "resource_name": { "type": "string", "description": "Name of the resource affected by the `action` in the audit log entry.\n", "example": "john.doe" }, "action": { "type": "string", "description": "Logged action.\n", "example": "create" }, "user": { "type": "object", "description": "Username and ID of the user that performed the action.\n", "properties": { "id": { "type": "string", "description": "User ID.", "format": "uuid", "example": "8384e9e5-2eb5-42d8-8615-218a97237143" }, "name": { "type": "string", "description": "Username.", "example": "jane.doe" } } }, "timestamp": { "type": "string", "format": "date-time", "description": "Timestamp for the audit log entry. Format: `YYYY-MM-DDTHH:MM:SSTZD` \n", "example": "2023-05-26T17:09:30Z" }, "description": { "type": "string", "description": "Friendly description of the action.", "example": "User has been created by api" }, "status": { "type": "string", "description": "Whether the action succeeded or failed.", "example": "success", "enum": [ "success", "failure" ] }, "client_ip": { "type": "string", "description": "IP address of the client that performed the action.", "example": "192.168.1.100" } } }, "AuthConfigDto": { "type": "object", "properties": { "id": { "type": "string", "description": "Auth config ID.", "example": "id" }, "status": { "type": "string", "description": "Auth config status.", "example": "status" } } }, "ClientAuthCertEnableResponse": { "$ref": "#/components/schemas/ClientAuthCertResponse" }, "UserRequest": { "type": "object", "description": "JSON payload for creating a standard or service user. **Note:** Standard users and service users require different parameters. Read each parameter's description to understand which fields are required for the different user types. \n", "properties": { "user_type": { "description": "User type (`standard` or `service`). Default is `service`. To create a standard user, you must provide a value of `standard`.\n", "default": "service", "type": "string", "enum": [ "standard", "service" ] }, "user_name": { "description": "Username. Only standard users have a `user_name`. Service users have a `friendly_name`, instead.\n", "type": "string", "example": "john.doe" }, "first_name": { "description": "User's first name. Required when creating a standard user. Ignored when creating a service user.\n", "type": "string", "example": "John" }, "last_name": { "description": "User's last name. Required when creating a standard user. Ignored when creating a service user.\n", "type": "string", "example": "Doe" }, "end_date": { "description": "For service users, end date for when the service user can access DigiCert ONE. If omitted, the service user does not expire. Ignored for standard users. Format: `YYYY-MM-DDTHH:MM:SSTZD`.\n", "type": "string", "example": "2022-04-30T23:59:59Z" }, "friendly_name": { "description": "User friendly name. Only service users have a `friendly_name`. Standard users have a `user_name`, instead.", "type": "string", "example": "Friendly name", "maxLength": 255 }, "roles": { "type": "array", "items": { "type": "string" }, "example": [ "AM_ACCOUNT_ADMIN", "DSM_DOCUMENT_SIGNER", "AM_DEFAULT_USER" ], "description": "List of roles to assign the user. Roles determine what the user can see and do inside of DigiCert ONE.\n" }, "permissions": { "type": "array", "items": { "type": "string" }, "example": [ "MANAGE_AM_ACCOUNT_USER", "VIEW_AM_USER", "MANAGE_IOT_DIVISION", "VIEW_AM_ACCOUNT" ], "deprecated": true, "description": "List of permissions for each Manager the service user can access.\n\n**Deprecated.** Use `roles` to configure user access, instead.\n" }, "description": { "type": "string", "description": "User description.", "example": "Example description", "maxLength": 255 }, "accounts": { "type": "array", "description": "List of account IDs for each account the user can access. When creating a standard user, the first account in this list is the user's primary account, and is used for authorization.\n", "items": { "format": "uuid", "type": "string" }, "example": [ "d95b8006-ddae-4643-b5a3-ebffbad077a7" ] }, "email": { "description": "User email address. \n\n- For standard users, provide the email address of the individual you are creating a user for.\n- For service users, provide the email address of the individual managing the service user's credentials. This individual is not required to be a DigiCert ONE administrator.\n", "type": "string", "example": "jane@example.com", "maxLength": 255 }, "locale": { "type": "string", "example": "en_US", "description": "User locale. Must be one of the locales returned by the /locales endpoint." }, "phone_number": { "description": "User phone number. Optional when creating a standard user. Ignored when creating a service user.\n", "type": "string", "example": 12345678901 }, "password": { "type": "string", "example": "Password1!", "description": "Password for a standard user to sign in to DigiCert ONE. Ignored when creating a service user.\n\n**Note:** This field is optional. Standard users created without a password receive an email with instructions to create a password and finish setting up their account.\n" } }, "required": [ "friendly_name", "email", "accounts", "roles", "user_name", "first_name", "last_name" ] }, "CreateUserResponse": { "type": "object", "properties": { "id": { "type": "string", "description": "User ID.", "format": "uuid", "example": "fb5bcea7-4436-47b9-9e73-d47f8f8a363b" }, "email": { "type": "string", "description": "User email address. For service users, email address of the person managing the service user credentials.", "example": "jane@example.com" }, "status": { "type": "string", "description": "User status.", "example": "ACTIVE", "enum": [ "ACTIVE", "DELETED", "PENDING", "LOCKED" ] }, "access_scope": { "type": "string", "description": "User access scope.", "example": "account", "enum": [ "account" ] }, "primary_account_id": { "type": "string", "format": "uuid", "description": "Account ID for the user's primary account.", "example": "63dfc763-10f7-4448-b277-1e0c6f9f82cd" }, "created_at": { "type": "string", "description": "Date and time the user was created. Format: `YYYY-MM-DDTHH:MM:SSTZD`.\n", "example": "2021-06-10T18:34:36Z" }, "friendly_name": { "type": "string", "description": "User friendly name.", "example": "Example friendly name" }, "description": { "type": "string", "description": "User description.", "example": "Example user description" }, "end_date": { "type": "string", "description": "Service user end date. Not applicable to standard users. Format: `YYYY-MM-DDTHH:MM:SSTZD`.\n", "example": "2022-04-30T23:59:59Z" }, "api_token": { "$ref": "#/components/schemas/APIAccessTokenResponse" }, "accounts": { "type": "array", "items": { "$ref": "#/components/schemas/AccountResponse" } }, "applications": { "type": "array", "items": { "$ref": "#/components/schemas/Application" } } } }, "UserResponse": { "type": "object", "description": "User details.\n\n**Note**: Properties that do not apply to the user are omitted from the response. For example, if the user is a service user (`\"user_type\": \"service\"`), the user details object does not include a `user_name`, `first_name`, `last_name`, or any other property that does not apply to service users.\n", "properties": { "id": { "type": "string", "format": "uuid", "example": "8714d398-d4bc-430f-97ca-9498279f9325", "description": "User ID." }, "user_name": { "type": "string", "description": "Username.", "example": "example_user" }, "saml_user_name": { "type": "string", "example": "example_user", "description": "SAML single sign-on username. Omitted if none exists." }, "oidc_user_name": { "type": "string", "description": "OpenID Connect (ODIC) single sign-on username. Omitted if none exists.", "example": "example_user" }, "first_name": { "description": "User first name.", "type": "string", "example": "John" }, "last_name": { "description": "User last name.", "type": "string", "example": "Doe" }, "email": { "type": "string", "description": "User email address.", "example": "bob@example.com" }, "phone": { "type": "string", "description": "User phone number.", "example": "+1 (123) 456-7890" }, "status": { "type": "string", "example": "ACTIVE", "description": "User status.", "enum": [ "ACTIVE", "DELETED", "PENDING", "LOCKED" ] }, "access_scope": { "type": "string", "example": "account", "description": "User access scope.", "enum": [ "account" ] }, "active": { "type": "boolean", "example": true, "description": "If true, the user is active. Otherwise, false." }, "primary_account_id": { "type": "string", "format": "uuid", "description": "Account ID for the user's primary account.", "example": "4d3d4da0-e5c5-4647-b02f-e182ba034b86" }, "created_at": { "type": "string", "description": "Date and time the user was created. Format: `YYYY-MM-DDTHH:MM:SSTZD`.\n", "example": "2021-06-10T18:34:36Z" }, "created_by": { "type": "string", "format": "uuid", "description": "Created by user ID.", "example": "5bc66ff4-98c0-419c-bb39-eebf14e0ee81" }, "user_type": { "type": "string", "example": "standard", "description": "User type.", "enum": [ "standard", "service" ] }, "friendly_name": { "type": "string", "description": "User friendly name.", "example": "Example friendly name" }, "description": { "type": "string", "description": "User description.", "example": "Description" }, "end_date": { "type": "string", "description": "Service user end date. Not applicable to standard users. Format: `YYYY-MM-DDTHH:MM:SSTZD`.\n", "example": "2022-04-30T23:59:59Z" }, "locale": { "type": "string", "example": "en_US", "description": "User locale. One of the locales returned by the /locales endpoint." }, "user_confirmed_lang": { "description": "If true, user confirmed their language and will no longer see the configuration popup to change or confirm the language they see in DigiCert ONE. Otherwise, false.", "type": "boolean", "example": true }, "disable_api_access_token": { "type": "boolean", "description": "If true, API access token creation is disabled for this user. Otherwise, false.", "example": false }, "disable_cac_upload": { "type": "boolean", "description": "If true, client authentication certificate upload is disabled for this user. Otherwise, false.", "example": false }, "applications": { "type": "array", "items": { "$ref": "#components/schemas/Application" } }, "accounts": { "type": "array", "items": { "$ref": "#/components/schemas/AccountResponse" } } } }, "SignInMethods": { "type": "object", "properties": { "mfaStatus": { "type": "string", "description": "Whether multi-factor authentication is enabled or disabled for the sign in method.", "example": "disabled", "enum": [ "enabled", "disabled" ] }, "signInMethod": { "type": "string", "description": "A method for signing into the account.", "example": "standard", "enum": [ "standard", "sso" ] }, "status": { "type": "string", "description": "Status of the sign in method.", "example": "enabled", "enum": [ "enabled", "disabled" ] }, "clientAuthCertLoginEnabled": { "type": "boolean", "description": "If true, client authentication certificate login is enabled for this sign in method. Otherwise, false.", "example": false } } }, "LocaleResponse": { "type": "array", "description": "List of objects with locale details.", "items": { "type": "object", "properties": { "code": { "type": "string", "description": "Locale code.", "enum": [ "de_DE", "en_US", "es_ES", "fr_FR", "it_IT", "ja_JP", "ko_KR", "pt_PT", "ru_RU", "zh_CN", "zh_TW" ] }, "language": { "type": "string", "description": "Locale language.", "enum": [ "Deutsch", "English", "Español", "Français", "Italiano", "日本語", "한국어", "Português", "Русский", "简体中文", "繁體中文" ] } } } }, "APIAccessTokenResponse": { "type": "object", "description": "Object with API key details.", "properties": { "id": { "type": "string", "format": "uuid", "example": "ccbea236-75ef-4ce3-8b90-f554c4a15ec4", "description": "API key ID." }, "user_id": { "type": "string", "format": "uuid", "example": "090ca555-1261-4858-a913-d553a6a7fe9d", "description": "ID of the user the key belongs to." }, "name": { "type": "string", "example": "apikey", "description": "API key name." }, "token": { "type": "string", "example": "aivnekrjweo_wekqnvoek", "description": "API key." }, "end_date": { "type": "string", "example": "2021-06-24T23:59:59Z", "format": "date", "description": "Date and time the API key expires. Format: `YYYY-MM-DDTHH:MM:SSTZD`\n" }, "start_date": { "type": "string", "example": "2021-06-02T00:28:24Z", "description": "Date and time the API key is valid from. Format: `YYYY-MM-DDTHH:MM:SSTZD`\n" }, "active": { "type": "boolean", "example": true, "description": "If true, the API key is active. Otherwise, false." }, "enabled": { "type": "boolean", "description": "If true, the API key is enabled. Otherwise, false.", "example": true }, "masked_api_key": { "type": "string", "example": "*************0f8db", "description": "Masked API key." } } }, "APIAccessTokenRequest": { "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string", "description": "Name of the API key", "example": "Api key" }, "end_date": { "description": "End date for when the api key can be used. Format: `YYYY-MM-DDTHH:MM:SSTZD`\n", "type": "string", "example": "2023-04-30T23:59:59Z" }, "user_id": { "type": "string", "description": "user_id can be current user's id or service user's id from any accessible account. user_id is optional. When user_id is absent,\nAPI will create API Key for the current user.\n", "example": "8b210e38-b8a9-41df-a96e-1ffe4512f6d1" } } }, "APIAccessTokenPutRequest": { "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string", "description": "Name of the API Key", "example": "Api key" }, "end_date": { "description": "End date for when the api key can be used. Format: `YYYY-MM-DDTHH:MM:SSTZD`\n", "type": "string", "example": "2023-04-30T23:59:59Z" }, "enabled": { "type": "boolean", "description": "If true, the API key is enabled. Otherwise, false.\n", "example": "true" } } }, "ClientAuthCertificateRequest": { "type": "object", "required": [ "csr", "name", "expiration_date" ], "properties": { "csr": { "type": "string", "description": "Certificate signing request (CSR) for the client authentication certificate.", "example": "-----BEGIN CERTIFICATE REQUEST-----\n•••\n•••\n-----END CERTIFICATE REQUEST-----\n" }, "name": { "type": "string", "description": "Unique friendly name for the certificate.", "example": "Certificate Name", "maxLength": 256 }, "expiration_date": { "type": "string", "example": "2024-04-30T00:00:00Z", "format": "date", "description": "Date and time the client certificate expires. Format: `YYYY-MM-DDTHH:MM:SSTZD`\n" } } }, "ClientAuthCertResponse": { "type": "object", "properties": { "id": { "description": "Client authentication certificate ID.", "type": "string", "format": "uuid", "example": "e281fe3b-fb97-4183-a4fa-205913a7aee4" }, "user_id": { "description": "ID of the user associated with the certificate.", "type": "string", "format": "uuid", "example": "8b210e38-b8a9-41df-a96e-1ffe4512f6d1" }, "name": { "type": "string", "description": "Unique friendly name for the certificate.", "example": "Certificate Name" }, "common_name": { "type": "string", "description": "Certificate common name.", "example": "59997243-34b2-42ef-8d7e-0401f39aa6b3" }, "end_date": { "description": "End date for when the authentication certificate can be used. This date restricts the use of the certificate, not its validity. Format: `YYYY-MM-DDTHH:MM:SSTZD`\n", "type": "string", "example": "2023-04-30T23:59:59Z" }, "start_date": { "type": "string", "description": "Start date for when the authentication certificate can be used. Format: `YYYY-MM-DDTHH:MM:SSTZD`\n", "example": "2021-06-10T00:00:00Z" }, "enabled": { "type": "boolean", "description": "If true, the authentication certificate is enabled. Otherwise, false.", "example": true }, "serial_number": { "type": "string", "description": "Authentication certificate serial number.", "example": "" }, "public_key": { "type": "string", "description": "Authentication certificate public key.", "example": "" } } }, "OrganizationResponse": { "type": "object", "description": "Object containing organization details. An organization object only contains the `address`, `address2`, `zip_code`, `city`, `state`, `country`, and `phone` fields if these values exist for the organization.\n", "properties": { "id": { "type": "string", "format": "uuid", "example": "0eb94a89-6649-48c3-a927-89e0f5c00911", "description": "Organization ID." }, "name": { "type": "string", "example": "DigiCert Inc.", "description": "Organization name." }, "address": { "type": "string", "example": "2801 N Thanksgiving Way", "description": "Organization address." }, "address2": { "type": "string", "description": "Secondary address information.", "example": "Suite 500" }, "zip_code": { "type": "string", "description": "Organization postal code.", "example": 84043 }, "city": { "type": "string", "description": "Organization city.", "example": "Lehi" }, "state": { "type": "string", "description": "Organization state or province.", "example": "Utah" }, "country": { "type": "string", "description": "Two-letter organization country code.", "example": "US" }, "phone": { "type": "string", "description": "Organization phone number.", "example": "+1 (123) 456-7890" }, "account": { "type": "object", "description": "Object containing name and ID of account the organization belongs to.", "properties": { "id": { "type": "string", "description": "Account ID.", "format": "uuid", "example": "14887f62-0019-40fd-8f95-26c0b442b1e9" }, "name": { "type": "string", "example": "Example Account", "description": "Account name." } } }, "active": { "type": "boolean", "description": "If true, organization is active. Otherwise, false.", "example": true }, "editable": { "type": "boolean", "description": "If true, the organization can be edited. Otherwise, false.", "example": true } } }, "AccountRequest": { "type": "object", "description": "Object with account details for creating or updating an account.", "required": [ "name", "service_period" ], "properties": { "name": { "type": "string", "description": "Account name. Letters, numbers, and these special characters allowed: , . ' - ( ) + & # / ~ ; @\n", "example": "Example account" }, "service_period": { "type": "object", "description": "Object with service period details.", "required": [ "to" ], "properties": { "from": { "type": "string", "description": "Account service period start date. Format: `YYYY-MM-DD`.\n", "example": "2024-01-01", "format": "date" }, "to": { "type": "string", "description": "Account service period end date. Format: `YYYY-MM-DD`\n", "example": "2025-01-01", "format": "date" } } }, "is_standard_login": { "type": "boolean", "description": "If true, standard login is enabled for the account. Defaults to true.\n\n**Note:** This field is only used on create. It is ignored on update. To update standard login, use the setup endpoints.\n", "default": true, "example": true }, "mfa_enabled": { "type": "boolean", "description": "If true, multi-factor authentication is enabled for the account.", "example": false }, "locale": { "type": "string", "description": "Account locale. Must be one of the locales returned by the `/locales` endpoint.\n", "example": "en_US" }, "type": { "type": "string", "description": "Account type. Defaults to `standard`.\n\n**Note:** This field is only used on create. It is ignored on update.\n", "example": "standard", "enum": [ "standard", "partner" ] }, "partner_account_id": { "type": "string", "description": "Partner account ID. Required when creating a partner-managed account.\n\n**Note:** This field is only used on create. It is ignored on update.\n", "format": "uuid", "example": "90171939-7ae7-4884-85d4-9a5ccc670fa6" } } }, "UserRole": { "type": "object", "description": "Object with user role details.", "properties": { "id": { "type": "string", "format": "uuid", "description": "User role ID.", "example": "5e0bd5fe-117f-4049-b686-1548b1ee5e14" }, "name": { "type": "string", "description": "User role name.", "example": "AM_ACCOUNT_ADMIN" }, "display_name": { "type": "string", "description": "User role display name.", "example": "AM ACCOUNT ADMIN" }, "description": { "type": "string", "description": "User role description.", "example": "Admin role with view and manage permissions" }, "type": { "type": "string", "description": "User role type. \n\nPossible values:\n* `default`: Default system role.\n* `custom`: Custom role.\n", "example": "default" }, "status": { "type": "string", "description": "User role status.", "enum": [ "ACTIVE", "ARCHIVED" ] }, "access_scope": { "description": "User role access scope.", "type": "string", "enum": [ "account" ] } } } } }, "paths": { "/account/api/v1/api-access-token": { "get": { "tags": [ "API keys" ], "description": "Use this endpoint to get a list of objects with details about your API keys.\nUsers can get -\n - Their own API key\n - Service user API key for accounts they can access\n", "operationId": "listApiTokens", "summary": "List API keys", "parameters": [ { "name": "user_id", "required": true, "description": "User ID. This ID must belong to the user who submits the request or service user's id from any accessible account.", "in": "query", "schema": { "type": "string", "format": "uuid" }, "example": "fa5e727c-0527-44e0-9004-5fdc347b0b3f" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "description": "List of objects with API key details.", "type": "array", "items": { "$ref": "#/components/schemas/APIAccessTokenResponse" } }, "example": [ { "id": "7b5d83e7-6e5f-4ade-ad48-111c6f3420f7", "user_id": "e7ea1214-d688-48ba-aa1b-131fb2867ac5", "name": "API key name", "end_date": "2022-05-30T23:59:59Z", "start_date": "2021-06-25T21:20:06Z", "active": true, "enabled": true, "masked_api_key": "*************9e2a1" } ] } } } } }, "post": { "tags": [ "API keys" ], "summary": "Create API key", "operationId": "createApiToken", "description": "Use this endpoint to generate API key.\nUsers can generate -\n- Their own API key\n- Service user API key for accounts they can access\n\nCreate API token will be returning unmasked api key.\n", "requestBody": { "required": true, "properties": { "name": { "type": "string", "description": "A descriptive name for the API key to help identify its purpose", "minLength": 1, "maxLength": 100, "example": "Production Integration Key" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APIAccessTokenRequest" }, "example": { "name": "My API Key", "end_date": "2025-12-31T23:59:59Z", "user_id": "e7ea1214-d688-48ba-aa1b-131fb2867ac5" } } } }, "responses": { "201": { "description": "API key created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APIAccessTokenResponse" }, "example": { "id": "7b5d83e7-6e5f-4ade-ad48-111c6f3420f7", "user_id": "e7ea1214-d688-48ba-aa1b-131fb2867ac5", "name": "My API Key", "end_date": "2025-12-31T23:59:59Z", "start_date": "2024-12-03T21:20:06Z", "active": true, "enabled": true, "masked_api_key": "*************9e2a1" } } } } } } }, "/account/api/v1/api-access-token/{id}": { "get": { "tags": [ "API keys" ], "description": "Get details about a specific API key by ID.\nUsers can view -\n- Their own API keys\n- Service user API keys from accounts they can access\n", "operationId": "getApiTokenById", "summary": "Get API key by ID", "parameters": [ { "name": "id", "required": true, "description": "API key ID", "in": "path", "schema": { "type": "string", "format": "uuid" }, "example": "7b5d83e7-6e5f-4ade-ad48-111c6f3420f7" } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APIAccessTokenResponse" }, "example": { "id": "7b5d83e7-6e5f-4ade-ad48-111c6f3420f7", "user_id": "e7ea1214-d688-48ba-aa1b-131fb2867ac5", "name": "API key name", "end_date": "2022-05-30T23:59:59Z", "start_date": "2021-06-25T21:20:06Z", "active": true, "enabled": true, "masked_api_key": "*************9e2a1" } } } } } }, "put": { "tags": [ "API keys" ], "description": "Use this endpoint to update an existing API key.\n Users can update:\n - Their own API key\n - Service user API key of accounts they can access\n", "operationId": "updateApiToken", "summary": "Update API key", "parameters": [ { "name": "id", "required": true, "description": "API key ID", "in": "path", "schema": { "type": "string", "format": "uuid" }, "example": "7b5d83e7-6e5f-4ade-ad48-111c6f3420f7" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APIAccessTokenPutRequest" }, "example": { "name": "Updated API Key Name", "enabled": false, "end_date": "2025-12-31T23:59:59Z" } } } }, "responses": { "200": { "description": "API key updated successfully", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/APIAccessTokenResponse" }, "example": { "id": "7b5d83e7-6e5f-4ade-ad48-111c6f3420f7", "user_id": "e7ea1214-d688-48ba-aa1b-131fb2867ac5", "name": "Updated API Key Name", "end_date": "2025-12-31T23:59:59Z", "start_date": "2021-06-25T21:20:06Z", "active": true, "enabled": false, "masked_api_key": "*************9e2a1" } } } } } }, "delete": { "tags": [ "API keys" ], "description": "Use this endpoint to delete an API key. \nUsers can delete:\n- Their own API key\n- Service user API key of accounts they can access\n", "operationId": "deleteApiToken", "summary": "Delete API key", "parameters": [ { "name": "id", "required": true, "description": "API key ID", "in": "path", "schema": { "type": "string", "format": "uuid" }, "example": "7b5d83e7-6e5f-4ade-ad48-111c6f3420f7" } ], "responses": { "204": { "description": "No content" } } } }, "/account/api/v1/account": { "get": { "tags": [ "Accounts" ], "operationId": "listAccounts", "description": "Use this endpoint to get a list of DigiCert ONE accounts.\n", "summary": "List accounts", "parameters": [ { "in": "query", "name": "active", "description": "Filters results by account status. If not provided, returns a list of `active` accounts. Accepts `all` (all accounts), `true` (active accounts), or `false` (inactive accounts).", "schema": { "type": "string", "enum": [ "all", true, false ], "default": true } }, { "in": "query", "name": "name", "description": "Name of a specific account to fetch.", "schema": { "type": "string", "example": "Account name" } }, { "in": "query", "name": "account_ids", "description": "Optional list of account IDs to return. Pass multiple values as repeated query parameters,\nfor example: `?account_ids=id_1&account_ids=id_2`.\n", "style": "form", "explode": true, "schema": { "type": "array", "items": { "type": "string" }, "example": [ "id_1", "id_2" ] } } ], "responses": { "200": { "description": "List of accounts", "content": { "application/json": { "schema": { "type": "array", "description": "List of objects with account details.", "items": { "$ref": "#/components/schemas/AccountResponse" } }, "examples": { "Successful request": { "value": [ { "id": "50580ac7-60e4-4df2-a834-d12c1ab79afb", "name": "Example account 1", "active": true, "service_period": { "from": "2021-05-25", "to": "2022-05-25" }, "friendly_identifier": "5258283", "admins": [ { "id": "833e4906-fc45-4bd3-841e-40506c0e8ca8", "email": "api_service_user_1@example.com" }, { "id": "fa8285c7-5e35-4ea8-8cc4-dc95f7dc3cd6", "email": "api_service_user_2@example.com" }, { "id": "7d78b46a-c635-4bda-8b6d-13802046a963", "name": "John Doe", "email": "account_user_1@example.com" } ], "sign_in_methods": [ { "signInMethod": "standard", "status": "enabled", "mfaStatus": "disabled", "clientAuthCertLoginEnabled": false } ], "oauth_clients": [], "locale": "en_US", "type": "standard", "packages": [] }, { "id": "be5ffbd2-1a50-4675-912f-2fe015812f87", "name": "Example account 2", "active": true, "service_period": { "from": "2021-05-26", "to": "2022-05-26" }, "friendly_identifier": "7092363", "admins": [], "sign_in_methods": [ { "signInMethod": "standard", "status": "enabled", "mfaStatus": "disabled", "clientAuthCertLoginEnabled": false } ], "oauth_clients": [], "locale": "en_US", "type": "standard", "federated_account_id": "6c1188f3-3b09-4bd1-b54b-0f6fc011444c", "packages": [] } ] } } } } } } }, "post": { "operationId": "createAccount", "tags": [ "Accounts" ], "description": "Use this endpoint to create a new DigiCert ONE account.\n\n**Required permissions**: `MANAGE_AM_ACCOUNT`\n\n**Access scope**: PARTNER or higher\n", "summary": "Create account", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountRequest" }, "examples": { "Create account": { "value": { "name": "Example account", "service_period": { "from": "2024-01-01", "to": "2025-01-01" }, "locale": "en_US" } } } } } }, "responses": { "201": { "description": "Account created successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "ID of the newly created account.", "format": "uuid", "example": "ad65390a-0380-4522-bab6-f007c447757a" } } }, "examples": { "Success": { "value": { "id": "ad65390a-0380-4522-bab6-f007c447757a" } } } } } }, "400": { "description": "Bad request. Invalid or missing required fields.", "content": { "application/json": { "schema": { "type": "object", "properties": { "errors": { "type": "array", "items": { "type": "object", "properties": { "code": { "type": "string" }, "message": { "type": "string" } } } } } }, "examples": { "Missing name": { "value": { "errors": [ { "code": "validation_error", "message": "Account name must be provided" } ] } } } } } } } } }, "/account/api/v1/account/{account_id}": { "get": { "operationId": "getAccountDetails", "tags": [ "Accounts" ], "description": "Use this endpoint to get details for a DigiCert ONE account.\n", "summary": "Get account details", "parameters": [ { "in": "path", "name": "account_id", "description": "ID of the account to query.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "90171939-7ae7-4884-85d4-9a5ccc670fa6" }, { "in": "query", "name": "is_federated_account_id", "description": "When true, treat the provided account_id as a federated account ID instead of a standard account UUID.\n", "required": false, "schema": { "type": "boolean" }, "example": false } ], "responses": { "200": { "description": "Account details", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountResponse" }, "examples": { "Success": { "value": { "id": "ad65390a-0380-4522-bab6-f007c447757a", "name": "Example account 1", "active": true, "service_period": { "from": "2021-05-26", "to": "2022-05-26" }, "friendly_identifier": "7092363", "admins": [ { "id": "f7e866c9-768c-4442-adc9-abe2ba4b69d1", "name": "Jane Doe", "email": "jane.doe@example.com" } ], "sign_in_methods": [ { "signInMethod": "standard", "status": "enabled", "mfaStatus": "disabled", "clientAuthCertLoginEnabled": false } ], "oauth_clients": [], "locale": "en_US", "type": "standard", "federated_account_id": "6c1188f3-3b09-4bd1-b54b-0f6fc011444c", "packages": [] } } } } } } } }, "put": { "operationId": "updateAccount", "tags": [ "Accounts" ], "summary": "Update account", "description": "Use this endpoint to update an existing DigiCert ONE account.\n\n**Required permissions**: `MANAGE_AM_ACCOUNT`\n\n**Access scope**: PARTNER or higher\n\n**Note:** The following `AccountRequest` fields are ignored on update and only apply during account creation: `standard_login`, `mfa_enabled`, `type`, `partner_account_id`, `federated_account_id`. The `service_period.from` value is also preserved from the existing account.\n", "parameters": [ { "in": "path", "name": "account_id", "description": "ID of the account to update.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "90171939-7ae7-4884-85d4-9a5ccc670fa6" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountRequest" }, "examples": { "Update account": { "value": { "name": "Updated account name", "service_period": { "from": "2024-01-01", "to": "2025-06-01" }, "locale": "en_US" } } } } } }, "responses": { "200": { "description": "Account updated successfully", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountResponse" }, "examples": { "Success": { "value": { "id": "ad65390a-0380-4522-bab6-f007c447757a", "name": "Updated account name", "active": true, "service_period": { "from": "2024-01-01", "to": "2025-06-01" }, "friendly_identifier": "7092363", "admins": [ { "id": "f7e866c9-768c-4442-adc9-abe2ba4b69d1", "name": "Jane Doe", "email": "jane.doe@example.com" } ], "sign_in_methods": [ { "signInMethod": "standard", "status": "enabled", "mfaStatus": "disabled", "clientAuthCertLoginEnabled": false } ], "oauth_clients": [], "locale": "en_US", "type": "standard", "packages": [] } } } } } }, "400": { "description": "Bad request. Invalid or missing required fields.", "content": { "application/json": { "schema": { "type": "object", "properties": { "errors": { "type": "array", "items": { "type": "object", "properties": { "code": { "type": "string" }, "message": { "type": "string" } } } } } } } } } } } }, "/account/api/v1/audit-log": { "get": { "tags": [ "Audit logs" ], "operationId": "listAuditLogs", "summary": "List audit log entries", "description": "Use this endpoint to get a list of audit log entries for DigiCert® Account Manager.\n", "parameters": [ { "in": "query", "name": "user_name", "description": "Limits results to audit log entries with a `user_name` value that contains the given string.", "schema": { "type": "string", "example": "john.doe" } }, { "in": "query", "name": "action", "description": "Limits results to audit log entries for the given action (exact match).", "schema": { "type": "string", "enum": [ "CREATE", "UPDATE", "DELETE", "LOGIN", "EXPIRE", "LOGOUT", "UPDATE_PASSWORD", "RESET_PASSWORD", "TERMS_AND_CONDITIONS", "LOGIN_ERROR", "SEND_RESET_PASSWORD", "UPDATE_TOTP", "DISABLED", "ENABLED", "LICENSE_REGISTERED", "LOW_LICENSE_WARNING_SENT", "ACCOUNT_EXPIRY_EMAIL_SENT", "API_ACCESS_TOKEN_EXPIRY_EMAIL_SENT", "CLIENT_AUTH_CERT_EXPIRY_EMAIL_SENT", "FEATURE_ENABLED", "FEATURE_DISABLED", "SERVICE_USER_EXPIRY_EMAIL_SENT", "SAML_IDP_CERT_EXPIRY_EMAIL_SENT", "RESET_PASSWORD_ERROR", "LINK_ACCOUNT", "LINK_USER", "MIGRATE_ACCOUNT", "MIGRATE_USER", "PACKAGE_SELECTED", "PACKAGE_UPGRADED", "MIGRATE_ROLES" ] } }, { "in": "query", "name": "resource_types", "description": "Limits results to audit log entries for the given resource types (exact match).\n\nTo get audit log entries for more than one resource type, use a comma-separated list. For example, appending the following query string to your request URL returns audit log entries for accounts, users, and API keys: `?resource_types=ACCOUNT,USER,APIKEY`\n", "schema": { "type": "string", "enum": [ "ACCOUNT", "USER", "SERVICE_USER", "APIKEY", "CLIENT_AUTH_CERT", "SAML2_CONFIG", "OIDC_CONFIG", "SSO_SAML", "BASIC_AUTH", "DIGEST_AUTH", "OAUTH_CLIENT", "OAUTH_CONFIG", "LICENSE", "BASIC_AUTH_MFA", "SSO_SAML_MFA", "CLIENT_AUTH_CERT_MFA", "SSO_OIDC", "SSO_OIDC_MFA", "DIGICERT", "DIGICERT_MFA", "ROLE", "ORGANIZATION", "SSO_OIDC_IDP_MFA" ] } }, { "in": "query", "name": "resource_id", "description": "Limits results to audit log entries for the resource with the given ID (exact match).", "schema": { "type": "string", "format": "uuid", "example": "ea8302d3-5e6a-4eff-b0b0-85909edc7f02" } }, { "in": "query", "name": "status", "description": "Limits results to audit log entries with the given status (exact match).", "schema": { "type": "string", "enum": [ "SUCCESS", "FAILURE" ] } }, { "in": "query", "name": "account_id", "description": "Limits results to audit log entries for the account with the given ID (exact match).", "schema": { "format": "uuid", "type": "string", "example": "da65e6a3-1962-4316-a1d3-9aa39e6f29c7" } }, { "in": "query", "name": "from", "description": "Limits results to audit log entries created on or after the given date or date-time.\n\nAccepts either a date (`YYYY-MM-DD`) or a UTC date-time (`YYYY-MM-DDTHH:mm:ssZ`). When only a date is given, the start of that day (`00:00:00` UTC) is used.\n", "schema": { "type": "string", "example": "2023-05-01T00:00:00Z" } }, { "in": "query", "name": "to", "description": "Limits results to audit log entries created on or before the given date or date-time.\n\nAccepts either a date (`YYYY-MM-DD`) or a UTC date-time (`YYYY-MM-DDTHH:mm:ssZ`). When only a date is given, the end of that day (`23:59:59` UTC) is used.\n", "schema": { "type": "string", "example": "2023-05-20T17:00:00Z" } }, { "in": "query", "name": "sort", "description": "Sort field and direction. Format: `:`.\n\nSort field values:\n- description\n- status\n- action\n- timestamp\n\nSort direction values:\n- `desc`\n- `asc` (default)\n\nExamples:\n- `sort=status:desc`\n- `sort=action`\n- `sort=timestamp:desc`\n- `sort=description:desc`\n", "schema": { "type": "string", "example": "action:desc" } }, { "in": "query", "name": "offset", "description": "Index of the first item to include in the results.\n", "schema": { "type": "integer", "example": 0, "default": 0 } }, { "in": "query", "name": "limit", "description": "Limits the number of item to include in the results. \n\nMaximum `limit` is 1000. Requests with `limit` values greater than 1000 are accepted, but the API automatically limits the response to 1000 items.\n", "schema": { "default": 20, "type": "integer", "maximum": 1000, "example": 20 } } ], "responses": { "200": { "description": "List of audit log entries", "content": { "application/json": { "schema": { "type": "object", "properties": { "total": { "type": "integer", "description": "Total number of items in the results.\n", "example": 1 }, "offset": { "type": "integer", "description": "Index of the first item in the results.\n", "example": 0, "default": 0 }, "limit": { "type": "integer", "description": "Limit on the number of items in the results.\n", "example": 20, "default": 20 }, "items": { "type": "array", "description": "List of audit log entries.\n", "items": { "$ref": "#/components/schemas/AuditLogEntry" } } } } } } } } } }, "/account/api/v1/client-auth-certificate": { "get": { "operationId": "getClientAuthCertificatesByUserId", "tags": [ "Client authentication certificates" ], "summary": "Get all client authentication certificates", "description": "Use this endpoint to get all client authentication certificates for specific user or service users accessible to the user\n", "parameters": [ { "name": "user_id", "in": "query", "description": "Limits results to client authentication certificates belonging to user ID. user_id can be current user's id or service user's id from any accessible account.\nuser_id is optional. When user_id is absent, API will return client authentication certificates for the current user and all accessible service users.\n", "schema": { "type": "string", "format": "uuid" }, "example": "979310f6-db24-4c67-bcb9-6926d92cd6ec" } ], "responses": { "200": { "description": "List of client authentication certificates", "content": { "application/json": { "schema": { "type": "array", "items": { "allOf": [ { "$ref": "#/components/schemas/ClientAuthCertResponse" }, { "type": "object", "properties": { "x509_cert": { "type": "string", "description": "PEM-encoded authentication certificate data.", "example": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\\n" }, "ca_cert": { "type": "string", "description": "PEM-encoded CA certificate data.", "example": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\\n" } } } ] } } } } } } }, "post": { "operationId": "createClientAuthCertificate", "tags": [ "Client authentication certificates" ], "summary": "Generate client authentication certificate", "description": "Use this endpoint to generate a client authentication certificate.\n", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientAuthCertificateRequest" } } } }, "responses": { "201": { "description": "Client authentication certificate created", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/ClientAuthCertResponse" }, { "type": "object", "properties": { "x509_cert": { "type": "string", "description": "PEM-encoded authentication certificate data.", "example": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\\n" }, "ca_cert": { "type": "string", "description": "PEM-encoded CA certificate data.", "example": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\\n" } } } ] } } } } } } }, "/account/api/v1/client-auth-certificate/{certificate_id}/enable": { "put": { "tags": [ "Client authentication certificates" ], "operationId": "enableClientAuthCertificate", "description": "Use this endpoint to enable or disable a client authentication certificate.\n", "summary": "Enable/disable client authentication certificate", "parameters": [ { "in": "path", "name": "certificate_id", "description": "Certificate ID of the client authentication certificate to enable or disable.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "6a136ee8-5129-4716-b0ca-7c28b6aca5c1" } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "If true, enables the certificate. If false, disables the certificate." } } }, "example": { "enabled": true } } } }, "responses": { "200": { "description": "Updated certificate information", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientAuthCertEnableResponse" } } } } } } }, "/account/api/v1/organization": { "get": { "operationId": "listOrganizations", "tags": [ "Organizations" ], "description": "Use this endpoint to get a list of objects with details about organizations you have permission to view.\n", "summary": "List organizations", "parameters": [ { "name": "account_id", "in": "query", "description": "Limits results to organizations belonging to the account with the given account ID. Must be an account the authenticated client has permission to view.\n", "schema": { "type": "string", "format": "uuid" }, "example": "979310f6-db24-4c67-bcb9-6926d92cd6ec" } ], "responses": { "200": { "description": "Organization list", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/OrganizationResponse" } }, "example": [ { "id": "d9674d8f-7ad6-4280-89b5-136c2aded288", "name": "DigiCert Inc.", "address": "2801 N Thanksgiving Way", "address2": "Suite 500", "zip_code": 84043, "city": "Lehi", "state": "Utah", "country": "US", "phone": "+1 (123) 456-7890", "account": { "id": "ff94b6dc-d360-4245-9918-0d0cf7ac347a", "name": "Example Account" }, "active": true, "editable": true } ] } } } } } }, "/account/api/v1/organization/{organization_id}": { "get": { "tags": [ "Organizations" ], "summary": "Get organization details", "operationId": "getOrganizationDetails", "description": "Use this endpoint to get information about a single organization you have permission to view.\n", "parameters": [ { "in": "path", "name": "organization_id", "required": true, "description": "Organization ID. The `id` for each organization is returned in the **List organizations** endpoint (GET `/account/api/v1/organization`).", "schema": { "type": "string", "format": "uuid", "example": "e3ff35d1-cea4-4508-acb5-99d9cbd91e80" } } ], "responses": { "200": { "description": "Organization details.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrganizationResponse" }, "example": { "id": "70a9fe0e-4ae8-4a5a-940a-c2526970885f", "name": "DigiCert Inc.", "address": "2801 N Thanksgiving Way", "address2": "Suite 500", "zip_code": 84043, "city": "Lehi", "state": "Utah", "country": "US", "phone": "+1 (123) 456-7890", "account": { "id": "ff89491b-4477-431d-95d6-780f535df61e", "name": "Example Account" }, "active": true, "editable": true } } } } } } }, "/account/api/v1/locales": { "get": { "operationId": "listLocales", "tags": [ "Locales" ], "description": "Use this endpoint to get a list of supported languages in your DigiCert ONE account. DigiCert ONE supports the following locales:\n\n- de_DE: Deutsch\n- en_US: English\n- es_ES: Español\n- fr_FR: Français\n- it_IT: Italiano\n- ja_JP: 日本語\n- nl_NL: Nederlands\n", "summary": "List locales", "responses": { "200": { "description": "Locales list", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LocaleResponse" }, "examples": { "Success": { "value": [ { "code": "de_DE", "language": "Deutsch" }, { "code": "en_US", "language": "English" }, { "code": "es_ES", "language": "Español" }, { "code": "fr_FR", "language": "Français" }, { "code": "it_IT", "language": "Italiano" }, { "code": "ja_JP", "language": "日本語" }, { "code": "nl_NL", "language": "Nederlands" } ] } } } } } } } }, "/account/api/v1/user/{user_id}": { "get": { "tags": [ "Users" ], "operationId": "getUserDetails", "description": "Use this endpoint to get details for a single user.\n\n**Note:** To get details for the administrator or service user that owns the API token or client authentication certificate used in the request, use `me` as the value of the `user_id` path parameter (for example, `account/api/v1/user/me`)\n", "summary": "Get user details", "parameters": [ { "in": "path", "name": "user_id", "description": "User ID. Use `me` to get details for the user that submits the request.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "05ef0765-ec2a-4318-89c4-cc6b9b958d70" } ], "responses": { "200": { "description": "User details", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserResponse" }, "example": { "id": "6792e182-4b96-4a2e-9061-14741be4234e", "email": "jane@example.com", "status": "ACTIVE", "access_scope": "account", "primary_account_id": "d6a3938c-f044-4092-b7f8-1804ae8e4efc", "created_at": "2021-06-23T08:55:19Z", "created_by": "5092c936-a5be-4c22-8bec-a649deef2c55", "user_type": "service", "friendly_name": "Example service user", "description": "", "locale": "en_US", "applications": [ { "id": "360348d9-1c3a-49fa-b82d-109ec552fd9f", "name": "Trust Lifecycle", "permissions": [ "VIEW_EM_SEAT", "VIEW_EM_AUDIT_LOG", "VIEW_EM_CERTIFICATE", "VIEW_EM_PROFILE" ] }, { "id": "c46187a2-243b-41a9-aedc-0518ab1b6cf6", "name": "IoT Trust", "permissions": [ "VIEW_IOT_CERTIFICATE", "VIEW_IOT_ENROLLMENT_PROFILE" ] }, { "id": "7e919d8a-07b2-44ee-96a0-9c2e1455e469", "name": "Document Trust", "permissions": [ "MANAGE_DSM_VIEW_CERTIFICATE_PROFILES", "MANAGE_DSM_ADD_VALIDATIONS", "MANAGE_DSM_VIEW_CERTIFICATE_TEMPLATES", "MANAGE_DSM_VIEW_VALIDATIONS" ] }, { "id": "6510a754-e47b-48c5-88cb-1cd677e801ce", "name": "Account Manager", "permissions": [ "MANAGE_AM_ACCOUNT", "VIEW_AM_AUDIT_LOG" ] }, { "id": "e70323fa-6014-42f3-a669-22645606d1fd", "name": "CA Manager", "permissions": [ "VIEW_CM_LICENSE" ] }, { "id": "a7081787-1dd8-492a-9c90-26ef079a7eb1", "name": "Software Trust", "permissions": [ "MANAGE_SM_CERTIFICATE_PROFILE", "VIEW_SM_CERTIFICATE", "SIGN_SM_HASH" ] } ], "accounts": [ { "id": "e14c40ed-6827-405f-afc9-c34051dd26e9", "name": "Example account", "active": true, "service_period": { "from": "2021-05-06", "to": "2030-05-06" }, "friendly_identifier": "1234567", "locale": "en_US" } ], "disable_api_access_token": false, "disable_cac_upload": false } } } } } }, "delete": { "operationId": "deleteUser", "tags": [ "Users" ], "summary": "Delete user", "description": "Use this endpoint to delete a standard or service user from DigiCert ONE.\n\n**Warning:** Deleting a service user can disrupt client integrations reliant on the service user's API credentials.\n", "parameters": [ { "in": "path", "name": "user_id", "description": "User ID.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "05ef0765-ec2a-4318-89c4-cc6b9b958d70" } ], "responses": { "204": { "description": "No content" } } }, "put": { "tags": [ "Users" ], "operationId": "updateUser", "description": "\nUse this endpoint to update a standard user or a service user in DigiCert ONE.\n\n## Standard users\n\nStandard users are DigiCert ONE administrators. When you update a standard user, you assign them a list of roles. These roles determine what the user can see and do inside DigiCert ONE.\n\nWhen updating a standard user, keep the following in mind:\n\n- In your JSON request body, you must provide a value of `standard` for the `user_type` parameter. By default, omitting the `user_type` parameter creates a service user.\n- You must provide a `user_name`, `first_name`, `last_name`, and a list of `roles` to assign the user.\n- When updating a standard user, you can assign them to multiple accounts using the `accounts` array. The first account the user's primary account, used for authorization. The user has access to the other accounts based on their permissions.\n\n## Service users\n\nService users are API tokens that aren't associated with an administrator. Service users enable you to build client integrations that don't inherit all of the same permissions as an administrator.\n\nWhen updating a service user, keep the following in mind:\n\n- In your JSON request, you must provide a list of `roles` to assign the service user. Only include roles needed for your API integration.\n- You must also provide a `friendly_name` for the user. DigiCert ONE logs actions linked to a service user under the service user's friendly name.\n", "summary": "Update user", "parameters": [ { "in": "path", "name": "user_id", "description": "User ID.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "05ef0765-ec2a-4318-89c4-cc6b9b958d70" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserRequest" }, "examples": { "Update service user": { "summary": "Update service user", "description": "Updates a service user in DigiCert ONE.", "value": { "friendly_name": "Service User Friendly Name", "email": "jane@example.com", "description": "Service user description", "end_date": "2026-04-30T23:59:59Z", "roles": [ "AM_ACCOUNT_ADMIN" ], "accounts": [ "34458530-87de-465f-9a2c-64ab81b1c957" ] } }, "Update standard user": { "summary": "Update standard user", "value": { "user_name": "john.doe", "first_name": "John", "last_name": "Doe", "email": "john.doe@example.com", "phone_number": "+12345678901", "user_type": "standard", "locale": "en_US", "accounts": [ "151404dc-4d7c-4d2b-9861-c0a1eaef29ff" ], "roles": [ "AM_ACCOUNT_ADMIN", "DSM_DOCUMENT_SIGNER", "AM_DEFAULT_USER" ] } } } } } }, "responses": { "200": { "description": "User details", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateUserResponse" }, "examples": { "Service user": { "summary": "Update service user", "description": "Service user details.", "value": { "id": "5e0bd5fe-117f-4049-b686-1548b1ee5e14", "email": "bob@example.com", "status": "ACTIVE", "access_scope": "account", "primary_account_id": "449922b5-aad9-4e5b-9025-2bd0daf3619e", "created_at": "2021-06-25T15:40:20Z", "friendly_name": "Service User Friendly Name", "description": "Example Service User", "api_token": { "id": "cdfcf47d-b47f-4919-bd1b-c62935312cea", "user_id": "a91c28de-7073-4dd9-9423-432f2ff1a767", "name": "Service User Friendly Name", "end_date": "2022-05-30T23:59:59Z", "enabled": true }, "accounts": [ { "id": "34e00e94-a8c2-4842-85bc-7633316b5df7", "name": "Example Account", "active": true, "service_period": { "from": "2021-05-06", "to": "2030-05-06" }, "friendly_identifier": "2460160", "locale": "en_US" } ], "applications": [ { "id": "248d14c4-d5b7-4280-93f3-6cd8fd5d3662", "name": "IoT Trust", "app_code": "device_manager", "permissions": [ "MANAGE_IOT_DIVISION" ] }, { "id": "68e8e9fa-01cf-468f-9aae-f8b3b915f9c3", "name": "Account Manager", "app_code": "account_manager", "permissions": [ "VIEW_AM_ACCOUNT", "MANAGE_AM_ACCOUNT_USER", "VIEW_AM_USER" ] } ], "end_date": "2022-05-30T23:59:59Z" } }, "Standard user": { "summary": "Update standard user", "description": "Standard user ID.", "value": { "id": "3700cb35-0604-4552-9193-65d1b41d8533", "email": "bob@example.com", "status": "ACTIVE", "access_scope": "account", "primary_account_id": "449922b5-aad9-4e5b-9025-2bd0daf3619e", "created_at": "2021-06-25T15:40:20Z", "created_by": "example", "accounts": [ { "id": "34e00e94-a8c2-4842-85bc-7633316b5df7", "name": "Example Account", "active": true, "service_period": { "from": "2021-05-06", "to": "2030-05-06" }, "friendly_identifier": "2460160", "locale": "en_US" } ], "applications": [ { "id": "248d14c4-d5b7-4280-93f3-6cd8fd5d3662", "name": "IoT Trust", "app_code": "device_manager", "permissions": [ "MANAGE_IOT_DIVISION" ] }, { "id": "68e8e9fa-01cf-468f-9aae-f8b3b915f9c3", "name": "Account Manager", "app_code": "account_manager", "permissions": [ "VIEW_AM_ACCOUNT", "MANAGE_AM_ACCOUNT_USER", "VIEW_AM_USER" ] } ] } } } } } } } } }, "/account/api/v1/users": { "post": { "operationId": "listSelectUsers", "tags": [ "Users" ], "description": "Use this endpoint to get a list of details for specific users.\n\nThe request payload is an array of up to 1000 user ID (UUID) values for each user you want details for. The response is a list of objects with details for each user in the list. The response only includes user details the authenticated client is authorized to view. User IDs that do not exist are ignored.\n", "summary": "List select users", "requestBody": { "content": { "application/json": { "schema": { "description": "List of user ID (UUID) values for each user to return details for. Cannot exceed 1000 IDs.", "type": "array", "maxItems": 1000, "items": { "type": "string", "description": "User ID (UUID).", "example": "e3997574-3e94-44f1-bf3a-e8f70ccb022a" }, "example": [ "e3997574-3e94-44f1-bf3a-e8f70ccb022a", "da74df30-5101-4351-98bf-738674d58f61", "72278b42-f4e3-4fe5-99d7-d2fdac4c4639" ] } } } }, "responses": { "200": { "description": "List of objects with user details.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserResponse" } }, "example": [ { "id": "e3997574-3e94-44f1-bf3a-e8f70ccb022a", "email": "jane@example.com", "status": "ACTIVE", "access_scope": "account", "primary_account_id": "43e74ba9-adc2-4d06-ab1a-1512c13e3f4e", "created_at": "2021-06-23T08:55:19Z", "created_by": "659cb536-494d-4942-baef-8713ceecccf4", "user_type": "service", "friendly_name": "Example service user", "description": "", "locale": "en_US", "applications": [ { "id": "f0fb2a68-8a79-4505-bcbc-77abfea82444", "name": "Trust Lifecycle", "permissions": [ "VIEW_EM_SEAT", "VIEW_EM_AUDIT_LOG", "VIEW_EM_CERTIFICATE", "VIEW_EM_PROFILE" ] }, { "id": "f6e1b9dc-34ac-41bd-8248-5c5978e8af27", "name": "IoT Trust", "permissions": [ "VIEW_IOT_CERTIFICATE", "VIEW_IOT_ENROLLMENT_PROFILE" ] }, { "id": "4746340a-bb7e-4c2d-9d5b-70bb83aa91ed", "name": "Document Trust", "permissions": [ "MANAGE_DSM_VIEW_CERTIFICATE_PROFILES", "MANAGE_DSM_ADD_VALIDATIONS", "MANAGE_DSM_VIEW_CERTIFICATE_TEMPLATES", "MANAGE_DSM_VIEW_VALIDATIONS" ] }, { "id": "ce539dff-35ba-4008-943e-bc0f628d8653", "name": "Account Manager", "permissions": [ "MANAGE_AM_ACCOUNT", "VIEW_AM_AUDIT_LOG" ] }, { "id": "ec27a788-bfa2-443a-a511-e2009a592318", "name": "CA Manager", "permissions": [ "VIEW_CM_LICENSE" ] }, { "id": "37f28480-1968-49f0-9f60-943a4237d202", "name": "Software Trust", "permissions": [ "MANAGE_SM_CERTIFICATE_PROFILE", "VIEW_SM_CERTIFICATE", "SIGN_SM_HASH" ] } ], "accounts": [ { "id": "10b796fc-2d5a-4944-ac82-2abb7997a09a", "name": "Example account", "active": true, "service_period": { "from": "2021-05-06", "to": "2030-05-06" }, "friendly_identifier": "1234567", "locale": "en_US" } ], "disable_api_access_token": false, "disable_cac_upload": false }, { "id": "da74df30-5101-4351-98bf-738674d58f61", "email": "john@example.com", "status": "ACTIVE", "access_scope": "account", "primary_account_id": "43e74ba9-adc2-4d06-ab1a-1512c13e3f4e", "created_at": "2021-06-23T08:55:19Z", "created_by": "659cb536-494d-4942-baef-8713ceecccf4", "user_type": "service", "friendly_name": "Example service user 2", "description": "", "locale": "en_US", "applications": [ { "id": "f0fb2a68-8a79-4505-bcbc-77abfea82444", "name": "Trust Lifecycle", "permissions": [ "VIEW_EM_SEAT", "VIEW_EM_AUDIT_LOG", "VIEW_EM_CERTIFICATE", "VIEW_EM_PROFILE" ] }, { "id": "f6e1b9dc-34ac-41bd-8248-5c5978e8af27", "name": "IoT Trust", "permissions": [ "VIEW_IOT_CERTIFICATE", "VIEW_IOT_ENROLLMENT_PROFILE" ] }, { "id": "4746340a-bb7e-4c2d-9d5b-70bb83aa91ed", "name": "Document Trust", "permissions": [ "MANAGE_DSM_VIEW_CERTIFICATE_PROFILES", "MANAGE_DSM_ADD_VALIDATIONS", "MANAGE_DSM_VIEW_CERTIFICATE_TEMPLATES", "MANAGE_DSM_VIEW_VALIDATIONS" ] }, { "id": "ce539dff-35ba-4008-943e-bc0f628d8653", "name": "Account Manager", "permissions": [ "MANAGE_AM_ACCOUNT", "VIEW_AM_AUDIT_LOG" ] }, { "id": "ec27a788-bfa2-443a-a511-e2009a592318", "name": "CA Manager", "permissions": [ "VIEW_CM_LICENSE" ] }, { "id": "37f28480-1968-49f0-9f60-943a4237d202", "name": "Software Trust", "permissions": [ "MANAGE_SM_CERTIFICATE_PROFILE", "VIEW_SM_CERTIFICATE", "SIGN_SM_HASH" ] } ], "accounts": [ { "id": "10b796fc-2d5a-4944-ac82-2abb7997a09a", "name": "Example account", "active": true, "service_period": { "from": "2021-05-06", "to": "2030-05-06" }, "friendly_identifier": "1234567", "locale": "en_US" } ], "disable_api_access_token": false, "disable_cac_upload": false }, { "id": "72278b42-f4e3-4fe5-99d7-d2fdac4c4639", "email": "alice@example.com", "status": "ACTIVE", "access_scope": "account", "primary_account_id": "43e74ba9-adc2-4d06-ab1a-1512c13e3f4e", "created_at": "2021-06-23T08:55:19Z", "created_by": "659cb536-494d-4942-baef-8713ceecccf4", "user_type": "service", "friendly_name": "Example service user 3", "description": "", "locale": "en_US", "applications": [ { "id": "f0fb2a68-8a79-4505-bcbc-77abfea82444", "name": "Trust Lifecycle", "permissions": [ "VIEW_EM_SEAT", "VIEW_EM_AUDIT_LOG", "VIEW_EM_CERTIFICATE", "VIEW_EM_PROFILE" ] }, { "id": "f6e1b9dc-34ac-41bd-8248-5c5978e8af27", "name": "IoT Trust", "permissions": [ "VIEW_IOT_CERTIFICATE", "VIEW_IOT_ENROLLMENT_PROFILE" ] }, { "id": "4746340a-bb7e-4c2d-9d5b-70bb83aa91ed", "name": "Document Trust", "permissions": [ "MANAGE_DSM_VIEW_CERTIFICATE_PROFILES", "MANAGE_DSM_ADD_VALIDATIONS", "MANAGE_DSM_VIEW_CERTIFICATE_TEMPLATES", "MANAGE_DSM_VIEW_VALIDATIONS" ] }, { "id": "ce539dff-35ba-4008-943e-bc0f628d8653", "name": "Account Manager", "permissions": [ "MANAGE_AM_ACCOUNT", "VIEW_AM_AUDIT_LOG" ] }, { "id": "ec27a788-bfa2-443a-a511-e2009a592318", "name": "CA Manager", "permissions": [ "VIEW_CM_LICENSE" ] }, { "id": "37f28480-1968-49f0-9f60-943a4237d202", "name": "Software Trust", "permissions": [ "MANAGE_SM_CERTIFICATE_PROFILE", "VIEW_SM_CERTIFICATE", "SIGN_SM_HASH" ] } ], "accounts": [ { "id": "10b796fc-2d5a-4944-ac82-2abb7997a09a", "name": "Example account", "active": true, "service_period": { "from": "2021-05-06", "to": "2030-05-06" }, "friendly_identifier": "1234567", "locale": "en_US" } ], "disable_api_access_token": false, "disable_cac_upload": false } ] } } } } } }, "/account/api/v1/user": { "get": { "tags": [ "Users" ], "operationId": "listAllUsers", "description": "Use this endpoint to get a list of all users.\n\nBy default, this endpoint returns an aggregated list of *standard users* (administrators) from each account the requesting user can access.\n* To filter results by account ID, use the `account_id` URL query string.\n* To get a list of **service user** details, use the `user_type=service` URL query string in your request.\n* To filter results by username or SAML username for standard users, use the `username` URL query string.\n* To filter results by email, use the `email` URL query string.\n", "summary": "List all users", "parameters": [ { "name": "account_id", "in": "query", "description": "Limits results to users belonging to account with the given ID.", "schema": { "type": "string", "format": "uuid" }, "example": "b9f880b7-5c92-4706-aeaa-da69d279dad0" }, { "name": "user_type", "description": "Limits results to users with the given `user_type`. Default: `standard`\n", "in": "query", "schema": { "type": "string", "default": "standard", "enum": [ "service", "standard" ] }, "example": "service" }, { "name": "user_name", "in": "query", "description": "Limits results to standard users with partial match for the given `user_name`. Matches against `user_name`, `oidc_user_name`, and `saml_user_name`.", "schema": { "type": "string" }, "example": "john.doe" }, { "name": "email", "in": "query", "description": "Limits results to users belonging to account with the given `email`.", "schema": { "type": "string" }, "example": "john.doe@example.com" }, { "name": "status", "in": "query", "description": "Limits results to users with the given status.", "schema": { "type": "string", "enum": [ "active", "disabled", "pending", "locked", "deleted" ] }, "example": "disabled" } ], "responses": { "200": { "description": "List of objects with user details.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserResponse" } }, "example": [ { "id": "783a6a45-b74b-4635-bb4b-69855910ccd3", "email": "jane@example.com", "status": "ACTIVE", "access_scope": "account", "primary_account_id": "130deba5-3ebb-43b2-8183-1a9940d460f5", "created_at": "2021-06-23T08:55:19Z", "created_by": "8f7f8b1f-63c1-4580-af7d-ea4cd890e8f7", "user_type": "service", "friendly_name": "Example service user", "description": "", "locale": "en_US", "applications": [ { "id": "2d3a72fd-ad44-4a9b-952a-2bcadb14a741", "name": "Trust Lifecycle", "permissions": [ "VIEW_EM_SEAT", "VIEW_EM_AUDIT_LOG", "VIEW_EM_CERTIFICATE", "VIEW_EM_PROFILE" ] }, { "id": "1a05282a-ec70-4da9-b921-933c070fcf80", "name": "IoT Trust", "permissions": [ "VIEW_IOT_CERTIFICATE", "VIEW_IOT_ENROLLMENT_PROFILE" ] }, { "id": "97b97f1b-8d1d-4203-a62c-0a209a1bea0a", "name": "Document Trust", "permissions": [ "MANAGE_DSM_VIEW_CERTIFICATE_PROFILES", "MANAGE_DSM_ADD_VALIDATIONS", "MANAGE_DSM_VIEW_CERTIFICATE_TEMPLATES", "MANAGE_DSM_VIEW_VALIDATIONS" ] }, { "id": "78c0355a-e1ca-4978-b60c-e9d66b9e1f30", "name": "Account Manager", "permissions": [ "MANAGE_AM_ACCOUNT", "VIEW_AM_AUDIT_LOG" ] }, { "id": "fd2b688d-43bd-4b4a-9fd6-f883ad9e813d", "name": "CA Manager", "permissions": [ "VIEW_CM_LICENSE" ] }, { "id": "7660bdb3-66e7-46e6-928f-dcae4d64ee91", "name": "Software Trust", "permissions": [ "MANAGE_SM_CERTIFICATE_PROFILE", "VIEW_SM_CERTIFICATE", "SIGN_SM_HASH" ] } ], "accounts": [ { "id": "4b13f12d-c8b2-4c49-a21f-9b399364f2ce", "name": "Example account", "active": true, "service_period": { "from": "2021-05-06", "to": "2030-05-06" }, "friendly_identifier": "1234567", "locale": "en_US" } ], "disable_api_access_token": false, "disable_cac_upload": false } ] } } } } }, "post": { "tags": [ "Users" ], "operationId": "createUser", "description": "\nUse this endpoint to create a standard user or a service user in DigiCert ONE.\n\n## Standard users\n\nStandard users are DigiCert ONE administrators. When you create a standard user, you assign them a list of roles. These roles determine what the user can see and do inside DigiCert ONE.\n\nWhen creating a standard user, keep the following in mind:\n\n- In your JSON request body, you must provide a value of `standard` for the `user_type` parameter. By default, omitting the `user_type` parameter creates a service user.\n- You must provide a `user_name`, `first_name`, `last_name`, and a list of `roles` to assign the user.\n- When creating a standard user, you can assign them to multiple accounts using the `accounts` array. The first account the user's primary account, used for authorization. The user has access to the other accounts based on their permissions. \n- You have the option to provide a `password` for the user. If you do, the user can use this password to sign in to DigiCert ONE. Otherwise, the user receives an email with instructions to create a password and finish setting up their account.\n- The Create user API endpoint only returns the ID of the newly created standard user. To get more user details, submit a request to the [Get user details](#/Users/getUserDetails) API endpoint.\n\n## Service users\n\nService users are API tokens that aren't associated with an administrator. Service users enable you to build client integrations that don't inherit all of the same permissions as an administrator.\n\nWhen creating a service user, keep the following in mind:\n\n- In your JSON request, you must provide a list of `roles` to assign the service user. Only include roles needed for your API integration.\n- You must also provide a `friendly_name` for the user. DigiCert ONE logs actions linked to a service user under the service user's friendly name.\n- In the response, the API returns the token ID (`api_token`) for the service user to authenticate to DigiCert ONE API services. This token is only returned once, and there is no way to retrieve it if lost. If a service user's API token is lost or compromised, disable the service user and create a new one.\n", "summary": "Create user", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserRequest" }, "examples": { "Create service user": { "summary": "Create service user", "description": "Creates a service user in DigiCert ONE.", "value": { "friendly_name": "Service User Friendly Name", "email": "jane@example.com", "description": "Service user description", "end_date": "2026-04-30T23:59:59Z", "roles": [ "AM_ACCOUNT_ADMIN" ], "accounts": [ "34458530-87de-465f-9a2c-64ab81b1c957" ] } }, "Create standard user": { "summary": "Create standard user", "value": { "user_name": "john.doe", "first_name": "John", "last_name": "Doe", "email": "john.doe@example.com", "phone_number": "+12345678901", "user_type": "standard", "locale": "en_US", "accounts": [ "151404dc-4d7c-4d2b-9861-c0a1eaef29ff" ], "roles": [ "AM_ACCOUNT_ADMIN", "DSM_DOCUMENT_SIGNER", "AM_DEFAULT_USER" ] } }, "Create standard user with password": { "summary": "Create standard user with password", "value": { "user_name": "john.doe", "first_name": "John", "last_name": "Doe", "email": "john.doe@example.com", "phone_number": "+12345678901", "user_type": "standard", "locale": "en_US", "accounts": [ "151404dc-4d7c-4d2b-9861-c0a1eaef29ff" ], "roles": [ "AM_ACCOUNT_ADMIN", "DSM_DOCUMENT_SIGNER", "AM_DEFAULT_USER" ], "password": "Password1!" } } } } } }, "responses": { "200": { "description": "User details", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateUserResponse" }, "examples": { "Service user": { "summary": "Create service user", "description": "Service user details.", "value": { "id": "5e0bd5fe-117f-4049-b686-1548b1ee5e14", "email": "bob@example.com", "status": "ACTIVE", "access_scope": "account", "primary_account_id": "449922b5-aad9-4e5b-9025-2bd0daf3619e", "created_at": "2021-06-25T15:40:20Z", "friendly_name": "Service User Friendly Name", "description": "Example Service User", "api_token": { "id": "cdfcf47d-b47f-4919-bd1b-c62935312cea", "user_id": "a91c28de-7073-4dd9-9423-432f2ff1a767", "name": "Service User Friendly Name", "token": "bedda3cd381bdfc8b17e10a0bfe350340cc4502c4ea9f41c3230ca6f8a17e97b7faa180727952e31fa1fe3227b2", "end_date": "2022-05-30T23:59:59Z", "enabled": true }, "accounts": [ { "id": "34e00e94-a8c2-4842-85bc-7633316b5df7", "name": "Example Account", "active": true, "service_period": { "from": "2021-05-06", "to": "2030-05-06" }, "friendly_identifier": "2460160", "locale": "en_US" } ], "applications": [ { "id": "248d14c4-d5b7-4280-93f3-6cd8fd5d3662", "name": "IoT Trust", "permissions": [ "MANAGE_IOT_DIVISION" ] }, { "id": "68e8e9fa-01cf-468f-9aae-f8b3b915f9c3", "name": "Account Manager", "permissions": [ "VIEW_AM_ACCOUNT", "MANAGE_AM_ACCOUNT_USER", "VIEW_AM_USER" ] } ], "end_date": "2022-05-30T23:59:59Z" } }, "Standard user": { "summary": "Create standard user", "description": "Standard user ID.", "value": { "id": "3700cb35-0604-4552-9193-65d1b41d8533" } } } } } } } } }, "/account/api/v1/role": { "get": { "tags": [ "User roles" ], "description": "Use this endpoint to get a list of user roles.\n\nBy default, returns all user roles (default and custom) for the authenticated user's primary account. To view roles for a different account the authenticated user can access, append the `account_id` query string to the request URL.\n", "summary": "List user roles", "operationId": "listUserRoles", "parameters": [ { "in": "query", "name": "application_code", "required": false, "description": "Limit results to user roles for the given Manager.\n\nPossible values:\n\n- `account_manager`: Account Manager\n\n- `ca_manager`: CA Manager\n\n- `device_manager`: IoT Trust Manager\n\n- `document_signing_manager`: Document Trust Manager\n\n- `enterprise_manager`: Trust Lifecycle Manager\n \n- `secure_software_manager`: Software Trust Manager\n", "schema": { "type": "string", "enum": [ "account_manager", "ca_manager", "device_manager", "document_signing_manager", "enterprise_manager", "secure_software_manager" ] } }, { "in": "query", "name": "account_id", "required": false, "description": "Get user roles for the account with the given ID. If not provided, returns a list of roles for the authenticated user's primary account.\n", "schema": { "type": "string", "format": "uuid", "example": "b033d97c-3215-4145-9ff1-6a7a734b269d" } } ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "description": "Object with user roles for each Manager.", "type": "object", "properties": { "ca_manager": { "type": "array", "description": "List of user roles for DigiCert® CA Manager.", "items": { "$ref": "#/components/schemas/UserRole" } }, "account_manager": { "type": "array", "description": "List of user roles for DigiCert® Account Manager.", "items": { "$ref": "#/components/schemas/UserRole" } }, "secure_software_manager": { "type": "array", "description": "List of user roles for DigiCert® Software Trust Manager.", "items": { "$ref": "#/components/schemas/UserRole" } }, "enterprise_manager": { "type": "array", "description": "List of user roles for DigiCert® Trust Lifecycle Manager.", "items": { "$ref": "#/components/schemas/UserRole" } }, "device_manager": { "type": "array", "description": "List of user roles for DigiCert® IoT Trust Manager.", "items": { "$ref": "#/components/schemas/UserRole" } }, "document_signing_manager": { "type": "array", "description": "List of user roles for DigiCert® Document Trust Manager.", "items": { "$ref": "#/components/schemas/UserRole" } }, "device_trust_manager": { "type": "array", "description": "List of user roles for DigiCert® Device Trust Manager.", "items": { "$ref": "#/components/schemas/UserRole" } } } }, "example": { "ca_manager": [ { "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "name": "CM_PKI_MANAGER", "display_name": "CM PKI MANAGER", "description": "Role with CM view permissions", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "name": "CM_KEY_ESCROW", "display_name": "Key Escrow", "description": "CM Key Escrow", "type": "default", "status": "ACTIVE", "access_scope": "account" } ], "account_manager": [ { "id": "c3d4e5f6-a7b8-9012-cdef-123456789012", "name": "AM_ACCOUNT_ADMIN", "display_name": "AM ACCOUNT ADMIN", "description": "Admin role with view and manage permissions", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "d4e5f6a7-b8c9-0123-defa-234567890123", "name": "AM_DEFAULT_USER", "display_name": "AM DEFAULT USER", "description": "Default role with view permissions", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "e5f6a7b8-c9d0-1234-efab-345678901234", "name": "AM_ACCOUNT_USER", "display_name": "AM ACCOUNT USER", "description": "Role with view permissions", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "f6a7b8c9-d0e1-2345-fabc-456789012345", "name": "AM_ACCOUNT_MANAGER", "display_name": "Account manager", "description": "AM Account manager", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "a7b8c9d0-e1f2-3456-abcd-567890123456", "name": "AM_USER_MANAGER", "display_name": "User manager", "description": "AM User manager", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "b8c9d0e1-f2a3-4567-bcde-678901234567", "name": "AM_VIEW_ONLY", "display_name": "View only", "description": "AM View only", "type": "default", "status": "ACTIVE", "access_scope": "account" } ], "secure_software_manager": [ { "id": "c9d0e1f2-a3b4-5678-cdef-789012345678", "name": "SSM_KEYLOCKER_ADMIN", "display_name": "SSM KEYLOCKER ADMIN", "description": "Admin role with view and manage SSM permissions", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "d0e1f2a3-b4c5-6789-defa-890123456789", "name": "SSM_KEYLOCKER_USER", "display_name": "SSM KEYLOCKER USER", "description": "Admin lite role", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "e1f2a3b4-c5d6-7890-efab-901234567890", "name": "SSM_LEAD", "display_name": "SSM Lead", "description": "SSM Lead", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "f2a3b4c5-d6e7-8901-fabc-012345678901", "name": "SSM_DEVELOPER", "display_name": "SSM Developer", "description": "SSM Developer", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "a3b4c5d6-e7f8-9012-abcd-123456789012", "name": "SSM_TEAM_LEAD", "display_name": "SSM Team Lead", "description": "SSM Team Lead", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "b4c5d6e7-f8a9-0123-bcde-234567890123", "name": "SSM_SIGNER", "display_name": "SSM Signer", "description": "SSM Signer", "type": "default", "status": "ACTIVE", "access_scope": "account" } ], "enterprise_manager": [ { "id": "c5d6e7f8-a9b0-1234-cdef-345678901234", "name": "EM_EPKI_ACCOUNT_MANAGER", "display_name": "EPKI Account Manager", "description": "EPKI Account Manager", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "d6e7f8a9-b0c1-2345-defa-456789012345", "name": "EM_EPKI_RECOVERY_MANAGER", "display_name": "EPKI Recovery Manager", "description": "EPKI Recovery Manager", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "e7f8a9b0-c1d2-3456-efab-567890123456", "name": "EM_EPKI_IMPORT_MANAGER", "display_name": "EPKI Import Manager", "description": "EPKI Import Manager", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "f8a9b0c1-d2e3-4567-fabc-678901234567", "name": "EM_EPKI_USER_&_CERT_MANAGER", "display_name": "EPKI User & cert manager", "description": "EPKI User & cert manager", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "a9b0c1d2-e3f4-5678-abcd-789012345678", "name": "EM_EPKI_CERT_PROFILE_MANAGER", "display_name": "EPKI Cert Profile Manager", "description": "EPKI Cert Profile Manager", "type": "default", "status": "ACTIVE", "access_scope": "account" } ], "device_manager": [ { "id": "b0c1d2e3-f4a5-6789-bcde-890123456789", "name": "IOT_CUSTOM_ROLE", "display_name": "Custom role", "description": "Custom role description.", "type": "custom", "status": "ACTIVE", "access_scope": "account" }, { "id": "c1d2e3f4-a5b6-7890-cdef-901234567890", "name": "IOT_ACCOUNT_MANAGER", "display_name": "IOT Account Manager", "description": "IOT Account Manager", "type": "default", "status": "ACTIVE", "access_scope": "account" } ], "document_signing_manager": [ { "id": "d2e3f4a5-b6c7-8901-defa-012345678901", "name": "DSM_DOCUMENT_SIGNER", "display_name": "DSM DOCUMENT SIGNER", "description": "Role with signer permissions", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "e3f4a5b6-c7d8-9012-efab-123456789012", "name": "DSM_CLIENT_ADMIN", "display_name": "DSM Client Admin", "description": "DSM Client Admin", "type": "default", "status": "ACTIVE", "access_scope": "account" }, { "id": "f4a5b6c7-d8e9-0123-fabc-234567890123", "name": "DSM_SIGNER", "display_name": "DSM Signer", "description": "DSM Signer", "type": "default", "status": "ACTIVE", "access_scope": "account" } ], "device_trust_manager": [ { "id": "a5b6c7d8-e9f0-1234-abcd-345678901234", "name": "DTM_ADMIN", "display_name": "DTM Admin", "description": "DTM Admin role", "type": "default", "status": "ACTIVE", "access_scope": "account" } ] } } } } } } } } }