{ "openapi": "3.0.1", "info": { "title": "Digicert Account REST APIs", "description": "Welcome to the DigiCert® Account API reference documentation! The DigiCert® Account APIs provides operations for managing DigiCert accounts and users.\n\n### Authentication\n\n- **API Key:**\n Pass your API key in the `X-API-Key` header with every request.\n- **Base URL:**\n Replace `{server}` with your DigiCert Account instance host (e.g., `https://accounts.digicert.com`).\n\n### Data Format\n\n- All requests and responses use `application/json`.\n- Use UTF-8 encoding.\n\n### Error Handling\n\n- Standard HTTP status codes are used (`200`, `201`, `204`, `400`, `403`, `404`, etc.).\n- Error responses include details for troubleshooting.\n\n### Reference\n\n- Request and response structures, including required fields and data types, are defined in the schema under the `components` section of this specification.\n\n---\n\n**Tip:**\n Always refer to the schema for required and optional fields for each endpoint.\n Authenticate every request.\n Use HTTPS for all API calls.\n", "version": "0.1" }, "security": [ { "ApiKeyAuth": [] } ], "servers": [ { "url": "https://{host}", "variables": { "host": { "default": "accounts.digicert.com" } } } ], "tags": [ { "name": "Accounts", "description": "View account details." }, { "name": "Users", "description": "View users and create Users." }, { "name": "API Tokens", "description": "Manage API access tokens." }, { "name": "Client Auth Certificates", "description": "Manage client authentication certificates." } ], "components": { "securitySchemes": { "ApiKeyAuth": { "type": "apiKey", "in": "header", "name": "X-API-Key" } }, "schemas": { "UserMergePatchRequest": { "type": "object", "description": "RFC 7396 JSON Merge Patch request for partial user updates. Only included fields are updated — omitted fields remain unchanged. Send an empty string to clear optional fields like `last_name`, `phone`.", "properties": { "first_name": { "type": "string", "description": "First name of the user. Cannot be blank if provided.", "maxLength": 255, "pattern": "^[\\w \\-().,&'#\\/~;!:_\" \\p{L}+\\P{Cc}+\\P{Cn}+\\P{Cs}+\\|\\p{M}+]*$", "example": "Jane" }, "last_name": { "type": "string", "description": "Last name of the user. Send empty string to clear.", "maxLength": 255, "example": "Smith" }, "user_name": { "type": "string", "description": "Username. Cannot be blank if provided. Must be globally unique.", "minLength": 1, "maxLength": 255, "pattern": "^[\\w\\-_!#$&'*+@.,\\p{L}+\\|\\p{M}+]*$", "example": "jane.smith" }, "email": { "type": "string", "format": "email", "description": "Email address. Cannot be blank if provided.", "maxLength": 255, "example": "jane.smith@example.com" }, "locale": { "type": "string", "description": "Locale code. Must be a valid locale.", "enum": [ "zh_CN", "zh_TW", "en_US", "fr_FR", "de_DE", "it_IT", "ja_JP", "ko_KR", "pt_BR", "es_ES" ], "example": "en_US" }, "phone": { "type": "string", "description": "Primary phone number. Send empty string to clear.", "pattern": "^(\\+\\d{1,3}( )?)?((\\(\\d{3}\\))|\\d{3})[- .]?(\\d{3}|\\d{4})[- .]?\\d{2,4}$", "example": "+1 5551234567" }, "saml_username": { "type": "string", "description": "SAML federation username. Cannot be blank if provided.", "example": "jane.smith@idp.example.com" }, "oidc_username": { "type": "string", "description": "OIDC federation username. Cannot be blank if provided.", "example": "jane.smith@oidc.example.com" } } }, "UserApiRequest": { "type": "object", "required": [ "first_name", "user_name", "email", "account_id" ], "properties": { "first_name": { "type": "string", "description": "**Required.** The first name of the user.", "maxLength": 255, "pattern": "^[\\w \\-().,&'#\\/~;!:_\" \\p{L}+\\P{Cc}+\\P{Cn}+\\P{Cs}+\\|\\p{M}+]*$", "example": "John" }, "last_name": { "type": "string", "description": "The last name of the user. *(Optional)*", "maxLength": 255, "pattern": "^[\\w \\-().,&'#\\/~;!:_\" \\p{L}+\\P{Cc}+\\P{Cn}+\\P{Cs}+\\|\\p{M}+]*$", "example": "Doe" }, "user_name": { "type": "string", "description": "**Required.** The username of the user. Allowed characters: letters, numbers, and special characters `- . , # & @ + ! * _`.", "minLength": 1, "maxLength": 255, "pattern": "^[\\w\\-_!#$&'*+@.,\\p{L}+\\|\\p{M}+]*$", "example": "johndoe123" }, "email": { "type": "string", "format": "email", "description": "**Required.** The email address of the user.", "maxLength": 255, "pattern": "^[a-zA-Z0-9_!#$&'*+\\{\\|\\}~^.\\-]+@[a-zA-Z0-9.\\-]+.[a-zA-Z]{2,63}$", "example": "john.doe@example.com" }, "saml_username": { "type": "string", "description": "SAML username for SSO login. *(Optional)*", "example": "john.doe@company.com" }, "oidc_username": { "type": "string", "description": "OIDC username for SSO login. *(Optional)*", "example": "john.doe@company.com" }, "account_id": { "type": "string", "format": "uuid", "description": "**Required.** The account ID (UUID) associated with the user.", "example": "941b29bc-1ae3-42e9-a70d-b9524024e2f6" }, "password": { "type": "string", "description": "The password for the user. *(Optional)*\n\n**Password requirements:**\n- Minimum 12 characters, maximum 255 characters\n- At least one uppercase letter\n- At least one lowercase letter\n- At least one digit\n- At least one special character\n", "minLength": 12, "maxLength": 255, "pattern": "^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[!-\\/:-@\\[-`{-~]).{12,255}$", "writeOnly": true }, "locale": { "type": "string", "description": "The locale of the user. *(Optional)* If not provided, defaults to the account locale.", "maxLength": 5, "enum": [ "zh_CN", "zh_TW", "en_US", "fr_FR", "de_DE", "it_IT", "ja_JP", "ko_KR", "pt_BR", "ru_RU", "es_ES", "nl_NL" ], "example": "en_US" }, "phone": { "type": "string", "description": "The primary phone number of the user. *(Optional)*", "pattern": "^(\\+\\d{1,3}( )?)?((\\(\\d{3}\\))|\\d{3})[- .]?(\\d{3}|\\d{4})[- .]?\\d{2,4}$", "example": "+1234567890" }, "other_phone": { "type": "string", "nullable": true, "description": "The secondary phone number of the user. *(Optional)*", "example": "+0987654321" }, "groups": { "type": "array", "description": "The groups the user belongs to. *(Optional)*\n\n**Predefined values:**\n| Value | Description |\n|---|---|\n| `ol_account_admin` | Account administrator |\n| `ol_end_user` | Standard account user |\n\nAdditional groups may exist if configured via SCIM or other provisioning methods.\n", "items": { "type": "string" }, "example": [ "ol_account_admin", "ol_end_user" ] }, "applications": { "type": "array", "description": "The applications the user has access to. *(Optional)*\n\n**Important:** Application codes must be assigned to the target account. Use only app codes that are configured for the account specified in `account_id`.\n\n**Common values (not exhaustive — values are configured per environment):**\n| Value | Application |\n|---|---|\n| `cc.prod.us` | CertCentral |\n| `tlm.prod.us` | Trust Lifecycle |\n| `iot.prod.us` | IoT Trust |\n| `dtm.prod.us` | Document Trust |\n| `devctm.prod.us` | Device Trust |\n| `stm.prod.us` | Software Trust |\n| `cm.prod.us` | CA Manager |\n| `dnstrust.prod.us` | DigiCert DNS |\n", "items": { "type": "string" }, "example": [ "tlm.prod.us", "cc.prod.us" ] }, "assigned_service_accounts": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "description": "Service provider accounts assigned to the user, mapped by application code. *(Optional)*\n\nThe key is the application code (currently only `cc.prod.us` is supported) and the value is an array of service provider account IDs.\n", "example": { "cc.prod.us": [ "889901", "889902" ] } }, "msa_accepted": { "type": "boolean", "description": "Whether the user has accepted the Master Service Agreement. *(Optional)*", "example": true } } }, "Application": { "type": "object", "description": "Details of Applications onboarded in Onelogin\n", "properties": { "id": { "type": "string", "description": "Application ID.", "format": "uuid", "example": "c0494f34-d6f9-478e-ba40-226154719526" }, "name": { "type": "string", "description": "Application name.", "example": "Account Manager" }, "app_code": { "type": "string", "description": "Application code.", "example": "tlm.prod.us", "enum": [ "dnstrust.prod.us", "dtm.prod.us", "devctm.prod.us", "stm.prod.us", "cm.prod.us", "cc.prod.us", "tlm.prod.us", "iot.prod.us" ] }, "optional": { "type": "boolean", "example": false }, "app_name": { "type": "string", "description": "Application name.", "example": "Trust Lifecycle", "enum": [ "DigiCert DNS", "Document Trust", "Device Trust", "Software Trust", "CA Manager", "Cert Central", "Trust Lifecycle", "IoT Trust" ] }, "icon": { "type": "string", "description": "Application icon.", "example": "tlIcon" }, "url": { "type": "string", "description": "Application URL.", "example": "/mpki/dashboard" }, "context": { "type": "string", "description": "Application context.", "example": "/mpki" }, "permissions": { "type": "array", "description": "List of permissions enabled for the user.", "items": { "type": "string" }, "example": [ "REVOKE_EM_CERTIFICATE", "RENEW_EM_CERTIFICATE", "VIEW_EM_AUDIT_LOG", "CREATE_EM_CERTIFICATE" ] }, "roles": { "type": "array", "description": "List of roles assigned to the user.", "items": { "type": "string" }, "example": [ "AM_ACCOUNT_ADMIN" ] } } }, "UserResponse": { "type": "object", "properties": { "id": { "type": "string", "example": "cd8212b4-6c99-4b9b-a9e0-b0eb29df19a4" }, "login": { "type": "string", "example": "John.doe" }, "user_name": { "type": "string", "minLength": 1, "maxLength": 255, "pattern": "^[\\w\\-_!#$&'*+@.,\\p{L}+\\|\\p{M}+]*$", "example": "John.doe" }, "saml_username": { "type": "string", "example": "John.doe@company.com" }, "oidc_username": { "type": "string", "example": "John.doe@company.com" }, "first_name": { "type": "string", "maxLength": 255, "pattern": "^[\\w \\-().,&'#\\/~;!:_\" \\p{L}+\\P{Cc}+\\P{Cn}+\\P{Cs}+\\|\\p{M}+]*$", "example": "john" }, "last_name": { "type": "string", "maxLength": 255, "pattern": "^[\\w \\-().,&'#\\/~;!:_\" \\p{L}+\\P{Cc}+\\P{Cn}+\\P{Cs}+\\|\\p{M}+]*$", "example": "Patel" }, "email": { "type": "string", "format": "email", "maxLength": 255, "pattern": "^[a-zA-Z0-9_!#$&'*+\\{\\|\\}~^.\\-]+@[a-zA-Z0-9.\\-]+.[a-zA-Z]{2,63}$", "example": "John.doe@company.com" }, "phone": { "type": "string", "example": "+13155554434" }, "access_scope": { "type": "string", "description": "Access scope of the user. Serialized in lowercase.", "enum": [ "system", "account" ], "example": "account" }, "status": { "type": "string", "description": "User status", "enum": [ "ACTIVE", "PENDING", "DELETED", "LOCKED", "DISABLED", "INACTIVE" ], "example": "ACTIVE" }, "primary_account_id": { "type": "string", "example": "2423499f-bae9-4623-b77c-3b17081707be" }, "login_url": { "type": "string", "example": "https://login.example.com" }, "sign_in_method": { "type": "object", "description": "User's sign-in method configuration.", "properties": { "sign_in_method": { "type": "string", "description": "Sign-in method identifier.", "example": "standard" }, "status": { "type": "string", "description": "Status of the sign-in method.", "example": "ENABLED" }, "mfa_status": { "type": "string", "description": "Multi-factor authentication status for this sign-in method.", "example": "ENABLED" }, "client_auth_cert_login_enabled": { "type": "boolean", "description": "Whether client-auth certificate login is enabled.", "example": false } } }, "user_created": { "type": "boolean", "example": true }, "mfa_status": { "type": "string", "description": "Multi-factor authentication status", "example": "ENABLED" }, "mfa_device_configured": { "type": "boolean", "example": true }, "reset_mfa": { "type": "boolean", "example": false }, "created_at": { "type": "string", "format": "date-time", "example": "2025-06-09T19:39:05Z" }, "created_by": { "type": "string", "example": "00000000-0000-0000-0000-000000000000" }, "user_type": { "type": "string", "description": "Type of user", "enum": [ "standard", "service" ], "example": "standard" }, "friendly_name": { "type": "string", "example": "John Doe" }, "description": { "type": "string", "example": "API user for DigiCert Account" }, "expiry_date": { "type": "string", "format": "date-time", "example": "2026-06-09T19:39:05Z" }, "locale": { "type": "string", "description": "The locale of the user.", "maxLength": 5, "enum": [ "zh_CN", "zh_TW", "en_US", "fr_FR", "de_DE", "it_IT", "ja_JP", "ko_KR", "pt_BR", "ru_RU", "es_ES", "nl_NL" ], "example": "en_US" }, "user_confirmed_lang": { "type": "boolean", "example": true }, "masked_api_key": { "type": "string", "example": "****abcd" }, "office_location": { "type": "string", "description": "Office location", "enum": [ "AU - Melbourne", "AU - Remote", "AU - Sydney", "BE - Mechelen", "BM - Hamilton", "CH - Geneva", "CH - Remote", "CH - St. Gallen", "CN - Beijin", "DE - München", "GB - London", "IE - Dublin", "IE - Remote", "IN - Bangalore", "IN - Pune", "JP - Kawasaki", "JP - Remote", "JP - Sapporo", "JP - Tokyo", "KR - Seoul", "NL - Amsterdam", "NL - Nieuwegein", "NL - Remote", "SA - Cape Town", "US - Eugene", "US - Lehi", "US - Mountain View", "US - Remote", "US - St. George" ], "example": "IN - Bangalore" }, "groups": { "type": "array", "items": { "$ref": "#/components/schemas/NameIdDto" }, "example": [ { "id": "group-1", "name": "Admins" } ] }, "role_count": { "type": "integer", "description": "Number of roles assigned to the user.", "example": 2 } }, "required": [ "id", "user_name", "email", "status", "access_scope", "user_type", "created_at", "groups" ] }, "IdDto": { "type": "object", "description": "Object containing only an `id` field.", "properties": { "id": { "type": "string", "example": "perm-001" } }, "required": [ "id" ] }, "NameIdDto": { "type": "object", "properties": { "id": { "type": "string", "example": "group-1" }, "name": { "type": "string", "example": "Admins" }, "source": { "type": "string", "description": "Optional source identifier (e.g., provisioning system). Omitted when null.", "example": "scim" } }, "description": "NameIdDto represents an object with an id, name, and optional source.\nProperties use snake_case, as reflected in JSON serialization.\n", "example": { "id": "group-1", "name": "Admins" } }, "APIAccessTokenResponse": { "type": "object", "description": "Object with API token details.", "properties": { "id": { "type": "string", "format": "uuid", "example": "ccbea236-75ef-4ce3-8b90-f554c4a15ec4", "description": "API token ID." }, "user_id": { "type": "string", "format": "uuid", "example": "090ca555-1261-4858-a913-d553a6a7fe9d", "description": "ID of the user the token belongs to." }, "name": { "type": "string", "example": "apitoken", "description": "API token name." }, "token": { "type": "string", "example": "aivnekrjweo_wekqnvoek", "description": "API token." }, "end_date": { "type": "string", "example": "2021-06-24T23:59:59Z", "format": "date-time", "description": "Date and time the API token expires. Format: `YYYY-MM-DDTHH:MM:SSTZD`\n" }, "start_date": { "type": "string", "example": "2021-06-02T00:28:24Z", "description": "Date and time the API token is valid from. Format: `YYYY-MM-DDTHH:MM:SSTZD`\n" }, "active": { "type": "boolean", "example": true, "description": "If true, the API token is active. Otherwise, false." }, "enabled": { "type": "boolean", "description": "If true, the API token is enabled. Otherwise, false.", "example": true }, "masked_api_key": { "type": "string", "example": "*************0f8db", "description": "Masked API token." }, "permissions": { "type": "array", "items": { "$ref": "#/components/schemas/IdDto" }, "description": "Permissions associated with this API token." }, "profiles": { "type": "array", "items": { "$ref": "#/components/schemas/IdDto" }, "description": "Profiles associated with this API token." } } }, "AccountApiRequest": { "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string", "description": "**Required.** Name of the account.", "example": "MyAccount" }, "locale": { "type": "string", "description": "Locale of the account. *(Optional)* Defaults to `en_US` if not provided.", "maxLength": 5, "enum": [ "zh_CN", "zh_TW", "en_US", "fr_FR", "de_DE", "it_IT", "ja_JP", "ko_KR", "pt_BR", "ru_RU", "es_ES", "nl_NL" ], "example": "en_US" }, "applications": { "type": "array", "description": "List of applications associated with the account. *(Optional)*\n\n**Common values (not exhaustive — values are configured per environment):**\n| Value | Application |\n|---|---|\n| `cc.prod.us` | CertCentral |\n| `tlm.prod.us` | Trust Lifecycle |\n| `iot.prod.us` | IoT Trust |\n| `dtm.prod.us` | Document Trust |\n| `devctm.prod.us` | Device Trust |\n| `stm.prod.us` | Software Trust |\n| `cm.prod.us` | CA Manager |\n| `dnstrust.prod.us` | DigiCert DNS |\n", "items": { "type": "string" }, "example": [ "cc.prod.us", "iot.prod.us" ] }, "instant_account_provisioning": { "type": "boolean", "description": "If true, the account will be provisioned in the service provider side immediately. *(Optional)*", "example": true } } }, "AccountApiResponse": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier of the account", "example": "12345" }, "name": { "type": "string", "description": "Name of the account", "example": "MyAccount" }, "active": { "type": "boolean", "description": "Indicates whether the account is active", "example": true }, "friendly_identifier": { "type": "string", "description": "Friendly identifier for the account", "example": "my_account_001" }, "users": { "type": "array", "items": { "$ref": "#/components/schemas/AdminDto" }, "description": "List of users associated with the account" }, "sign_in_methods": { "type": "array", "items": { "type": "string" }, "description": "List of supported sign-in methods", "example": [ "standard", "clientAuth", "ssoWithSaml", "ssoWithOidc", "digestAuth", "oAuthClientCredentials" ] }, "locale": { "type": "string", "description": "Locale of the account", "maxLength": 5, "enum": [ "zh_CN", "zh_TW", "en_US", "fr_FR", "de_DE", "it_IT", "ja_JP", "ko_KR", "pt_BR", "ru_RU", "es_ES", "nl_NL" ], "example": "en_US" }, "display_name": { "type": "string", "description": "Display name of the account", "example": "My Cool Account" }, "mfa_enabled": { "type": "boolean", "description": "Indicates if multi-factor authentication is enabled", "example": true }, "linked_service_provider": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "description": "Linked service provider accounts, keyed by application code.", "example": { "cc.prod.us": [ "889901", "889902" ] } }, "assigned_applications": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "description": "Apps assigned to this account, grouped by service-provider account id\n(the same SPA ids exposed in `linked_service_provider`).\n- For Account Manager (DC1) SPAs: intersection of\n `service_provider_account_application` and `account_application`\n (avoids over-population from `getExternalApplicationsBySourceAppId`).\n- For other SPs (CC, DNS, ...): values from `service_provider_account_application` directly.\n", "example": { "d1976e5a-dda1-40ed-b13f-ae24d4349e22": [ "am.local.us", "tlm.local.us", "stm.local.us" ], "fcc3d253-fd43-4024-8dd2-4283216c6cf4": [ "am.local.eu", "dtm.local.eu" ], "889901": [ "cc.local.us" ] } } } }, "AdminDto": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier of the admin", "example": "admin_123" }, "email": { "type": "string", "description": "Email of the admin", "example": "admin@example.com" }, "name": { "type": "string", "description": "Name of the admin", "example": "Admin User" } }, "required": [ "id", "email", "name" ] }, "UserApiResponse": { "allOf": [ { "$ref": "#/components/schemas/UserResponse" }, { "type": "object", "properties": { "active": { "type": "boolean", "example": true }, "other_phone": { "type": "string", "nullable": true, "description": "The secondary phone number of the user (optional).", "example": "+1-555-987-6543" }, "end_date": { "type": "string", "format": "date-time", "example": "2026-05-30T19:32:02Z" }, "applications": { "type": "array", "items": { "$ref": "#/components/schemas/ApplicationApiResponse" }, "example": [ { "app_code": "cc.prod.us" }, { "app_code": "tlm.prod.us" } ] }, "accounts": { "type": "array", "items": { "$ref": "#/components/schemas/AccountApiResponse" }, "example": [ { "id": "acc-1", "name": "Sample Account" }, { "id": "acc-2", "name": "Test Account" } ] }, "one_time_login_token": { "type": "string", "example": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." } } } ] }, "ApplicationApiResponse": { "type": "object", "properties": { "app_code": { "type": "string", "example": "APP-001" } }, "required": [ "app_code" ] }, "ApplicationResponse": { "type": "object", "description": "Full application details returned by the GET /user/me endpoint.", "properties": { "id": { "type": "string", "format": "uuid", "description": "Unique identifier of the application.", "example": "096559cb-114e-4af9-8e2c-d82fbb8a5aa5" }, "name": { "type": "string", "description": "Display name of the application.", "example": "Cert Central" }, "app_code": { "type": "string", "description": "Application code identifier.", "example": "cc.prod.us" }, "app_name": { "type": "string", "description": "Application name.", "example": "Cert Central" }, "icon": { "type": "string", "description": "Icon identifier for the application.", "example": "ccIcon" }, "url": { "type": "string", "description": "Application login URL.", "example": "https://www.digicert.com/account/oidc/digicert-idp/login" }, "context": { "type": "string", "description": "Application context path.", "example": "https:/" }, "short_app_code": { "type": "string", "description": "Short application code.", "example": "CC" }, "permissions": { "type": "array", "items": { "type": "string" }, "description": "Permissions the current user has for this application." }, "description": { "type": "string", "description": "Application description.", "example": "Cert Central" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "Roles assigned to the user for this application." }, "full_url": { "type": "string", "description": "Full application URL.", "example": "https://www.digicert.com/account/oidc/digicert-idp/login" }, "new_tab": { "type": "boolean", "description": "Whether to open the application in a new tab." }, "default_app": { "type": "boolean", "description": "Whether this is the default application.", "example": false }, "app_type": { "type": "string", "description": "Type of application.", "enum": [ "EXTERNAL", "DEFAULT", "INTERNAL", "INTERNAL_SERVICE" ], "example": "EXTERNAL" }, "create_dcone_account": { "type": "boolean", "description": "Whether to create a DC ONE account for this application." }, "is_retail": { "type": "boolean", "description": "Whether this is a retail application." } } }, "AccountMeResponse": { "type": "object", "description": "Account details returned by the GET /user/me endpoint.", "properties": { "id": { "type": "string", "format": "uuid", "description": "Unique identifier of the account.", "example": "c7bc17de-f610-480c-8f76-154c13a943e2" }, "name": { "type": "string", "description": "Name of the account.", "example": "System Account" }, "active": { "type": "boolean", "description": "Whether the account is active." }, "service_period": { "type": "object", "description": "Service period for the account.", "properties": { "from": { "type": "string", "format": "date", "description": "Start date of the service period." }, "to": { "type": "string", "format": "date", "description": "End date of the service period." } } }, "friendly_identifier": { "type": "string", "description": "Friendly account identifier." }, "admins": { "type": "array", "items": { "$ref": "#/components/schemas/AdminDto" }, "description": "Account administrators." }, "auth_config": { "type": "array", "description": "Authentication configuration.", "items": { "type": "object", "properties": { "id": { "type": "string" }, "status": { "type": "string" }, "type": { "type": "string" } } } }, "sign_in_methods": { "type": "array", "items": { "type": "string" }, "description": "Supported sign-in methods." }, "oauth_clients": { "type": "array", "description": "OAuth clients associated with the account.", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "status": { "type": "string" }, "oauth_client_id": { "type": "string" }, "oauth_client_account_id": { "type": "string" } } } }, "locale": { "type": "string", "description": "Account locale." }, "enabled_feature_ids": { "type": "array", "items": { "type": "string" }, "description": "Enabled feature IDs for the account." }, "display_name": { "type": "string", "description": "Display name of the account." }, "is_retail": { "type": "boolean", "description": "Whether this is a retail account." } } }, "UserMeApiResponse": { "allOf": [ { "$ref": "#/components/schemas/UserResponse" }, { "type": "object", "description": "Response for the GET /user/me endpoint. Includes full application details, permissions, user groups, and impersonation status.", "properties": { "active": { "type": "boolean", "example": true }, "other_phone": { "type": "string", "nullable": true, "description": "Secondary phone number.", "example": "+1-555-987-6543" }, "end_date": { "type": "string", "format": "date-time" }, "applications": { "type": "array", "description": "Full application details including URLs, icons, and permissions.", "items": { "$ref": "#/components/schemas/ApplicationResponse" } }, "accounts": { "type": "array", "description": "Accounts the user belongs to.", "items": { "$ref": "#/components/schemas/AccountMeResponse" } }, "permissions": { "type": "array", "description": "Permissions granted to the current user.", "items": { "type": "string" }, "example": [ "VIEW_OL_USER", "MANAGE_OL_ACCOUNT_USER", "VIEW_OL_ACCOUNT", "VIEW_OL_AUDIT_LOG" ] }, "user_groups": { "type": "array", "description": "Groups the current user belongs to.", "items": { "type": "string" }, "example": [ "ol_account_admin" ] }, "impersonating": { "type": "boolean", "description": "Whether the current session is an impersonation session.", "example": false } } } ] }, "CreateUserApiResponse": { "type": "object", "description": "Response returned when creating a new user. Only `id` is always present; `one_time_login_token` is included when a welcome login link is generated.", "properties": { "id": { "type": "string", "description": "The unique identifier (UUID) of the newly created user.", "example": "cd8212b4-6c99-4b9b-a9e0-b0eb29df19a4" }, "one_time_login_token": { "type": "string", "description": "A one-time login token for the user to set their password. Only present when the system generates a welcome login link.", "example": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." } }, "required": [ "id" ] }, "ClientAuthCertRequest": { "type": "object", "properties": { "name": { "type": "string", "description": "**Required.** Certificate name.", "maxLength": 256, "pattern": "^[\\w \\-().,&'#\\/~;!:_\" \\p{L}+\\P{Cc}+\\P{Cn}+\\P{Cs}+\\|\\p{M}+]*$", "example": "My Client Cert" }, "end_date": { "type": "string", "format": "date-time", "description": "Certificate expiration date. *(Optional)* If provided, must be a future or present date.", "example": "2027-12-31T23:59:59Z" }, "csr": { "type": "string", "description": "**Required.** Certificate Signing Request (CSR) in PEM format.", "example": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----" }, "common_name": { "type": "string", "description": "Common name for the certificate. *(Optional)* If not provided, it is extracted from the CSR or defaults to the user ID.", "example": "client.example.com" }, "enrollment_method": { "type": "string", "description": "Enrollment method. *(Optional)*", "example": "manual" }, "keystore_type": { "type": "string", "description": "Keystore type. *(Optional)*", "example": "PKCS12" }, "user_id": { "type": "string", "description": "User ID (for service token requests). *(Optional)* If not provided, uses the authenticated user's ID.", "example": "user-123" } }, "required": [ "name", "csr" ] }, "ClientAuthCertResponse": { "type": "object", "properties": { "id": { "type": "string", "description": "Certificate ID", "example": "cert-123" }, "user_id": { "type": "string", "description": "User ID", "example": "user-123" }, "name": { "type": "string", "description": "Certificate name", "example": "My Client Cert" }, "common_name": { "type": "string", "description": "Common name", "example": "client.example.com" }, "x509_cert": { "type": "string", "description": "X.509 certificate", "example": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----" }, "ca_cert": { "type": "string", "description": "CA certificate", "example": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----" }, "end_date": { "type": "string", "format": "date-time", "description": "Certificate expiration date", "example": "2024-12-31T23:59:59Z" }, "start_date": { "type": "string", "format": "date-time", "description": "Certificate start date", "example": "2023-01-01T00:00:00Z" }, "enabled": { "type": "boolean", "description": "Whether the certificate is enabled", "example": true }, "serial_number": { "type": "string", "description": "Certificate serial number", "example": "1234567890" }, "public_key": { "type": "string", "description": "Public key", "example": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----" }, "enrollment_method": { "type": "string", "description": "Enrollment method", "example": "manual" } } }, "EnableDto": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "**Required.** Whether to enable or disable the resource.", "example": true } }, "required": [ "enabled" ] } } }, "paths": { "/app/account/api/v1/account/{account_id}": { "put": { "summary": "Update an account", "operationId": "updateAccount", "tags": [ "Accounts" ], "parameters": [ { "in": "path", "name": "account_id", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "c00ed9d6-b708-458b-8078-205537dbbc4c" } ], "requestBody": { "description": "Account update request", "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountApiRequest" } } } }, "responses": { "204": { "description": "No Content - Account updated successfully" }, "403": { "description": "Forbidden - User does not have access to update this account" }, "400": { "description": "Bad Request - Validation error" } } }, "get": { "operationId": "getAccountDetails", "tags": [ "Accounts" ], "description": "Use this endpoint to get details for a DigiCert Account.\n", "summary": "Get account details", "parameters": [ { "in": "path", "name": "account_id", "description": "ID of the account to query.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "90171939-7ae7-4884-85d4-9a5ccc670fa6" } ], "responses": { "200": { "description": "Account details", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountApiResponse" }, "example": { "id": "acc-001", "name": "Main Account", "active": true, "friendly_identifier": "main-acct-2025", "users": [ { "id": "admin-01", "name": "Alice Doe", "email": "alice.doe@digicert.com" }, { "id": "admin-02", "name": "Bob Smith", "email": "Bob.Smith@digicert.com" } ], "sign_in_methods": [ "standard", "clientAuth", "ssoWithSaml", "ssoWithOidc", "digestAuth", "oAuthClientCredentials" ], "locale": "en_US", "display_name": "Main-Account-2556", "mfa_enabled": true, "linked_service_provider": { "cc.prod.us": [ "889901", "889902" ] }, "assigned_applications": { "889901": [ "cc.prod.us" ], "889902": [ "cc.prod.us" ] } } } } } } } }, "/app/account/api/v1/account": { "post": { "summary": "Create a new account", "operationId": "createAccount", "tags": [ "Accounts" ], "requestBody": { "description": "Account creation request", "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountApiRequest" } } } }, "responses": { "201": { "description": "Account successfully created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountApiResponse" }, "example": { "id": "acc-001" } } } }, "403": { "description": "Forbidden - User does not have access to update this account" }, "400": { "description": "Bad Request - Validation error" } } }, "get": { "tags": [ "Accounts" ], "operationId": "listAccounts", "description": "Use this endpoint to get a list of DigiCert accounts.\n", "summary": "List accounts", "parameters": [ { "in": "query", "name": "active", "description": "Filters results by account status. If not provided, returns a list of `active` accounts. Accepts `all` (all accounts), `true` (active accounts), or `false` (inactive accounts).", "schema": { "type": "string", "enum": [ "all", "true", "false" ], "default": "true" } }, { "in": "query", "name": "name", "description": "Name of a specific account to fetch.", "schema": { "type": "string", "example": "Account name" } } ], "responses": { "200": { "description": "List of accounts", "content": { "application/json": { "schema": { "type": "array", "description": "List of objects with account details.", "items": { "$ref": "#/components/schemas/AccountApiResponse" } }, "examples": { "Successful request": { "value": [ { "id": "517bce7b-9261-43f8-b69a-89ba52caed97", "name": "MyAccount222", "active": true, "friendly_identifier": "6051006", "users": [], "sign_in_methods": [], "locale": "en_US", "display_name": "MyAccount222-6051006", "mfa_enabled": true, "linked_service_provider": {} }, { "id": "9917bce7b-9261-43f8-b69a-89ba5aed97", "name": "MyAccount333", "active": true, "friendly_identifier": "605103306", "users": [], "sign_in_methods": [], "locale": "en_US", "display_name": "MyAccount333-6051006", "mfa_enabled": true, "linked_service_provider": {} } ] } } } } } } } }, "/app/account/api/v1/user/me": { "get": { "tags": [ "Users" ], "operationId": "getCurrentUser", "description": "Returns the details of the currently authenticated user.\n", "summary": "Get current user", "parameters": [ { "in": "query", "name": "hide_unavailable_applications", "required": false, "description": "If `true`, hides applications the user does not have access to. Defaults to `false`.", "schema": { "type": "boolean", "default": false } } ], "responses": { "200": { "description": "Current user details", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserMeApiResponse" } } } }, "401": { "description": "Unauthorized - No valid authentication provided" } } } }, "/app/account/api/v1/user/{user_id}": { "get": { "tags": [ "Users" ], "operationId": "getUserDetails", "description": "Use this endpoint to get details for a single user.\n", "summary": "Get user details", "parameters": [ { "in": "path", "name": "user_id", "description": "User ID. Enter the user's UUID.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "05ef0765-ec2a-4318-89c4-cc6b9b958d70" } ], "responses": { "200": { "description": "User details", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserApiResponse" }, "example": { "id": "dfcf473b-d6cd-4e46-9040-c57731674d96", "user_name": "John.account@digicert.com", "first_name": "John", "last_name": "Account", "email": "John.account@digicert.com", "phone": "+13155554434", "access_scope": "account", "status": "ACTIVE", "primary_account_id": "2423499f-bae9-4623-b77c-3b17081707be", "created_at": "2025-06-09T19:39:05Z", "created_by": "00000000-0000-0000-0000-000000000000", "user_type": "standard", "locale": "en_US", "role_count": 2, "other_phone": "", "groups": [ { "id": "group-1", "name": "ol_account_admin" } ], "applications": [ { "app_code": "cc.local.us" } ], "accounts": [ { "id": "2423499f-bae9-4623-b77c-3b17081707be", "name": "John", "active": true, "friendly_identifier": "2558748", "locale": "en_US", "display_name": "John-2558748", "mfa_enabled": true, "linked_service_provider": {} } ] } } } } } }, "delete": { "operationId": "deleteUser", "tags": [ "Users" ], "summary": "Delete user", "description": "Use this endpoint to delete a user\n", "parameters": [ { "in": "path", "name": "user_id", "description": "User ID.", "required": true, "schema": { "type": "string", "format": "uuid" }, "example": "05ef0765-ec2a-4318-89c4-cc6b9b958d70" } ], "responses": { "204": { "description": "No content" } } }, "put": { "summary": "Update user details", "description": "Updates the details of an existing user by their ID.\n\n> **When to use PUT vs PATCH:**\n> Use `PUT` when you want to **replace the entire user resource** — all required fields must be provided in every request, and any omitted optional fields will be reset to their defaults.\n> If you only need to update one or two fields (e.g., change a phone number), use `PATCH` instead to avoid accidentally overwriting other fields.\n\n### Request parameters\n\n| Name | Req/Opt | Type | Description |\n|---|---|---|---|\n| `first_name` | **required** | string | First name of the user. Max 255 characters. |\n| `last_name` | optional | string | Last name of the user. Max 255 characters. |\n| `user_name` | **required** | string | Username. Allowed characters: letters, numbers, `. , # & @ + ! * _ -`. Min 1, max 255 characters. |\n| `email` | **required** | string | Valid email address. Max 255 characters. |\n| `account_id` | **required** | string (UUID) | Account ID associated with the user. |\n| `saml_username` | optional | string | SAML username for SSO login. |\n| `oidc_username` | optional | string | OIDC username for SSO login. |\n| `locale` | optional | string | User locale. See allowed values in schema. |\n| `phone` | optional | string | Primary phone number. |\n| `groups` | optional | array | Groups to assign. Allowed: `ol_account_admin`, `ol_end_user`. |\n| `applications` | optional | array | Application codes to grant access. Must be app codes assigned to the target account. See allowed values in schema. |\n| `assigned_service_accounts` | optional | object | Service provider accounts mapped by app code. |\n\n**Note:** The user must be in `ACTIVE` status. Updating a `PENDING` or `DELETED` user will return a `403` error.\n", "operationId": "updateUser", "tags": [ "Users" ], "parameters": [ { "name": "user_id", "in": "path", "required": true, "description": "The unique identifier (UUID) of the user to update.", "schema": { "type": "string", "format": "uuid" }, "example": "05ef0765-ec2a-4318-89c4-cc6b9b958d70" } ], "requestBody": { "description": "The user details to update.", "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserApiRequest" }, "examples": { "Update User": { "summary": "Update User", "description": "Update User.", "value": { "first_name": "John", "last_name": "Doe", "user_name": "John.doe_123", "email": "john.doe@example.com", "saml_username": "john.doe@basf.com", "oidc_username": "john.doe@basf.com", "locale": "en_US", "phone": "+1-555-123-4567", "other_phone": "+1-555-987-6543", "account_id": "941b29bc-1ae3-42e9-a70d-b9524024e2f6", "groups": [ "ol_account_admin", "ol_end_user" ], "applications": [ "cc.prod.us", "iot.prod.us" ], "assigned_service_accounts": { "cc.prod.us": [ "889901", "889902" ] }, "msa_accepted": true } } } } } }, "responses": { "204": { "description": "No Content. The user was successfully updated." }, "400": { "description": "Bad Request. The input data is invalid." }, "401": { "description": "Unauthorized. The user is not authenticated." }, "403": { "description": "Forbidden. The user does not have the required permissions." }, "404": { "description": "Not Found. The user with the specified ID does not exist." }, "500": { "description": "Internal Server Error. An unexpected error occurred." } } }, "patch": { "summary": "Partial update user (JSON Merge Patch)", "description": "Partially updates a user using RFC 7396 JSON Merge Patch semantics.\nOnly included fields are modified — omitted fields remain unchanged.\n\n> **When to use PATCH vs PUT:**\n> Use `PATCH` when you want to **update specific fields** without affecting the rest of the user resource — only the fields you include in the request body are modified.\n> If you need to replace the entire user resource (including groups, applications, and service accounts), use `PUT` instead.\n\n- **Required fields** (`first_name`, `user_name`, `email`): Cannot be blank if provided.\n- **Optional fields** (`last_name`, `phone`, `locale`): Send empty string to clear.\n- **Federation fields** (`saml_username`, `oidc_username`): Cannot be blank if provided. Cannot be cleared via PATCH.\n\n### Request parameters\n\n| Name | Req/Opt | Type | Description |\n|---|---|---|---|\n| `first_name` | optional | string | First name. Cannot be blank if provided. Max 255 characters. |\n| `last_name` | optional | string | Last name. Send empty string to clear. |\n| `user_name` | optional | string | Username. Cannot be blank if provided. Must be globally unique. |\n| `email` | optional | string | Email address. Cannot be blank if provided. |\n| `locale` | optional | string | Locale code. Must be a valid locale if provided. |\n| `phone` | optional | string | Primary phone. Send empty string to clear. |\n| `saml_username` | optional | string | SAML federation username. Cannot be blank if provided. |\n| `oidc_username` | optional | string | OIDC federation username. Cannot be blank if provided. |\n\n**Note:** The user must be in `ACTIVE` status. Patching a non-active user returns a `400` error.\n", "operationId": "mergePatchUser", "tags": [ "Users" ], "parameters": [ { "name": "user_id", "in": "path", "required": true, "description": "The unique identifier (UUID) of the user to patch.", "schema": { "type": "string", "format": "uuid" }, "example": "05ef0765-ec2a-4318-89c4-cc6b9b958d70" } ], "requestBody": { "description": "Fields to update. Omitted fields are not changed.", "required": true, "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/UserMergePatchRequest" }, "examples": { "Update single field": { "summary": "Update first name only", "value": { "first_name": "Jane" } }, "Update multiple fields": { "summary": "Update name and phone", "value": { "first_name": "Jane", "last_name": "Smith", "phone": "+1 5551234567" } }, "Clear optional field": { "summary": "Clear phone number", "value": { "phone": "" } } } } } }, "responses": { "200": { "description": "OK. Returns the updated user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserApiResponse" } } } }, "400": { "description": "Bad Request. Invalid input or user is not active." }, "401": { "description": "Unauthorized. The user is not authenticated." }, "403": { "description": "Forbidden. The user does not have the required permissions." }, "404": { "description": "Not Found. The user with the specified ID does not exist." }, "500": { "description": "Internal Server Error. An unexpected error occurred." } } } }, "/app/account/api/v1/users": { "post": { "operationId": "listSelectUsers", "tags": [ "Users" ], "description": "Use this endpoint to get a list of details for specific users.\n\nThe request payload is an array of 1 to 1000 user ID (UUID) values for each user you want details for. At least one user ID is required. The response is a list of objects with details for each user in the list. The response only includes user details the authenticated client is authorized to view. User IDs that do not exist are ignored.\n", "summary": "List select users", "requestBody": { "content": { "application/json": { "schema": { "description": "List of user ID (UUID) values for each user to return details for. Must contain between 1 and 1000 IDs.", "type": "array", "minItems": 1, "maxItems": 1000, "items": { "type": "string", "description": "User ID (UUID).", "example": "e3997574-3e94-44f1-bf3a-e8f70ccb022a" }, "example": [ "e3997574-3e94-44f1-bf3a-e8f70ccb022a", "da74df30-5101-4351-98bf-738674d58f61", "72278b42-f4e3-4fe5-99d7-d2fdac4c4639" ] } } } }, "responses": { "200": { "description": "List of objects with user details.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/UserApiResponse" } }, "example": [ { "id": "dfcf473b-d6cd-4e46-9040-c57731674d96", "user_name": "John.account@digicert.com", "first_name": "John", "last_name": "Account", "email": "John.account@digicert.com", "phone": "+13155554434", "access_scope": "account", "status": "ACTIVE", "primary_account_id": "2423499f-bae9-4623-b77c-3b17081707be", "created_at": "2025-06-09T19:39:05Z", "created_by": "00000000-0000-0000-0000-000000000000", "user_type": "standard", "locale": "en_US", "role_count": 2, "other_phone": "", "groups": [ { "id": "group-1", "name": "ol_account_admin" } ], "applications": [ { "app_code": "cc.local.us" } ], "accounts": [ { "id": "2423499f-bae9-4623-b77c-3b17081707be", "name": "John", "active": true, "friendly_identifier": "2558748", "locale": "en_US", "display_name": "John-2558748", "mfa_enabled": true, "linked_service_provider": {} } ] } ] } } }, "400": { "description": "Bad Request - At least one user ID is required. The request payload cannot be empty." } } } }, "/app/account/api/v1/user": { "post": { "tags": [ "Users" ], "operationId": "createUser", "description": "Use this endpoint to create a new user in OneLogin.\n\n### Request parameters\n\n| Name | Req/Opt | Type | Description |\n|---|---|---|---|\n| `first_name` | **required** | string | First name of the user. Max 255 characters. |\n| `last_name` | optional | string | Last name of the user. Max 255 characters. |\n| `user_name` | **required** | string | Username. Allowed characters: letters, numbers, `. , # & @ + ! * _ -`. Min 1, max 255 characters. |\n| `email` | **required** | string | Valid email address. Max 255 characters. |\n| `account_id` | **required** | string (UUID) | Account ID to associate the user with. |\n| `password` | optional | string | Password. Min 12 chars, must include uppercase, lowercase, digit, and special character. |\n| `saml_username` | optional | string | SAML username for SSO login. |\n| `oidc_username` | optional | string | OIDC username for SSO login. |\n| `locale` | optional | string | User locale. See allowed values in schema. Defaults to account locale. |\n| `phone` | optional | string | Primary phone number. |\n| `other_phone` | optional | string | Secondary phone number. |\n| `groups` | optional | array | Groups to assign. Allowed: `ol_account_admin`, `ol_end_user`. |\n| `applications` | optional | array | Application codes to grant access. Must be app codes assigned to the target account. See allowed values in schema. |\n| `assigned_service_accounts` | optional | object | Service provider accounts mapped by app code (currently only `cc.prod.us`). |\n", "summary": "Create user", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserApiRequest" }, "examples": { "Create user": { "summary": "Create user", "value": { "first_name": "John", "last_name": "Doe", "user_name": "John.doe_123", "email": "john.doe@example.com", "saml_username": "john.doe@basf.com", "oidc_username": "john.doe@basf.com", "account_id": "941b29bc-1ae3-42e9-a70d-b9524024e2f6", "password": "dummy", "locale": "en_US", "phone": "+1-555-123-4567", "other_phone": "+1-555-987-6543", "groups": [ "ol_account_admin", "ol_end_user" ], "applications": [ "cc.prod.us", "dnstrust.prod.us", "iot.prod.us", "dtm.prod.us", "devctm.prod.us", "stm.prod.us", "cm.prod.us", "tlm.prod.us" ], "assigned_service_accounts": { "cc.prod.us": [ "889901", "889902" ] }, "msa_accepted": true } } } } } }, "responses": { "201": { "description": "User successfully created. Returns the user ID.\n**Note:** The newly created user will be in `PENDING` status until they complete activation via the welcome email.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateUserApiResponse" }, "example": { "id": "cd8212b4-6c99-4b9b-a9e0-b0eb29df19a4", "one_time_login_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." } } } } } } }, "/app/account/api/v1/api-access-token": { "get": { "tags": [ "API Tokens" ], "operationId": "getApiTokens", "description": "Use this endpoint to get API access tokens for a user.\n", "summary": "Get API access tokens", "parameters": [ { "in": "query", "name": "user_id", "description": "User ID to get tokens for.", "required": true, "schema": { "type": "string" }, "example": "user-123" } ], "responses": { "200": { "description": "List of API access tokens", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/APIAccessTokenResponse" } }, "example": [ { "id": "ccbea236-75ef-4ce3-8b90-f554c4a15ec4", "user_id": "090ca555-1261-4858-a913-d553a6a7fe9d", "name": "apitoken", "end_date": "2026-12-31T23:59:59Z", "start_date": "2026-06-08T00:28:24Z", "active": true, "enabled": true, "masked_api_key": "*************0f8db", "permissions": [ { "id": "perm-001" } ], "profiles": [ { "id": "profile-001" } ] } ] } } }, "400": { "description": "Bad Request - user_id parameter is required" }, "403": { "description": "Forbidden - User does not have access to this user's tokens" } } } }, "/app/account/api/v1/client-auth-certificate": { "post": { "tags": [ "Client Auth Certificates" ], "summary": "Create client authentication certificate", "description": "Creates a new client authentication certificate. For user-authenticated requests, the certificate is created for the current user. For service token requests, use the `user_id` field to specify the target user.\n\n### Request parameters\n\n| Name | Req/Opt | Type | Description |\n|---|---|---|---|\n| `name` | **required** | string | Certificate name. Max 256 characters. |\n| `csr` | **required** | string | Certificate Signing Request (CSR) in PEM format. |\n| `end_date` | optional | string (date-time) | Expiration date. Must be a future or present date. |\n| `common_name` | optional | string | Common name. Defaults to CSR common name or user ID. |\n| `enrollment_method` | optional | string | Enrollment method. |\n| `keystore_type` | optional | string | Keystore type (e.g., PKCS12). |\n| `user_id` | optional | string | User ID (service token requests only). |\n", "operationId": "createClientAuthCertificate", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientAuthCertRequest" }, "example": { "name": "My Client Cert", "csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----", "end_date": "2027-12-31T23:59:59Z", "common_name": "client.example.com", "enrollment_method": "manual", "keystore_type": "PKCS12", "user_id": "user-123" } } } }, "responses": { "201": { "description": "Certificate successfully created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientAuthCertResponse" }, "example": { "id": "cert-123", "user_id": "user-123", "name": "My Client Cert", "common_name": "client.example.com", "x509_cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----", "ca_cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----", "end_date": "2027-12-31T23:59:59Z", "start_date": "2026-06-08T00:00:00Z", "enabled": true, "serial_number": "1234567890", "public_key": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----", "enrollment_method": "manual" } } } }, "400": { "description": "Bad Request - Validation error (e.g., missing name or CSR)" }, "403": { "description": "Forbidden - User does not have required permissions" } } }, "get": { "tags": [ "Client Auth Certificates" ], "summary": "Get client authentication certificates for a user", "description": "Returns a list of client authentication certificates for the specified user. If `user_id` is not provided, returns certificates for the current user.\n", "operationId": "getClientAuthCertificates", "parameters": [ { "in": "query", "name": "user_id", "required": false, "description": "User ID to get certificates for. If not provided, uses the current user.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of client authentication certificates", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ClientAuthCertResponse" } }, "example": [ { "id": "cert-123", "user_id": "user-123", "name": "My Client Cert", "common_name": "client.example.com", "x509_cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----", "ca_cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----", "end_date": "2027-12-31T23:59:59Z", "start_date": "2026-06-08T00:00:00Z", "enabled": true, "serial_number": "1234567890", "public_key": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----", "enrollment_method": "manual" } ] } } }, "403": { "description": "Forbidden - User does not have required permissions" }, "400": { "description": "Bad Request - Invalid input data" } } } }, "/app/account/api/v1/client-auth-certificate/{id}/enable": { "put": { "tags": [ "Client Auth Certificates" ], "summary": "Enable client authentication certificate", "description": "Enable a client authentication certificate by its ID.", "operationId": "enableClientAuthCertificate", "parameters": [ { "in": "path", "name": "id", "required": true, "description": "The unique identifier of the client authentication certificate.", "schema": { "type": "string", "format": "uuid" }, "example": "6a136ee8-5129-4716-b0ca-7c28b6aca5c1" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnableDto" }, "example": { "enabled": true } } } }, "responses": { "200": { "description": "Updated certificate information", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientAuthCertResponse" }, "example": { "id": "6a136ee8-5129-4716-b0ca-7c28b6aca5c1", "user_id": "user-123", "name": "My Client Cert", "common_name": "client.example.com", "x509_cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----", "ca_cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----", "end_date": "2027-12-31T23:59:59Z", "start_date": "2026-06-08T00:00:00Z", "enabled": true, "serial_number": "1234567890", "public_key": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----", "enrollment_method": "manual" } } } }, "400": { "description": "Bad Request - Invalid input data" }, "403": { "description": "Forbidden - User does not have required permissions" } } } } } }