From ea7974e0939223cf39ad72d5eb6ea19bfa2be1ca Mon Sep 17 00:00:00 2001 From: Souf Date: Tue, 30 Jun 2026 18:30:10 +0200 Subject: [PATCH 01/12] feat!: add streamable HTTP transport; remove OIDC browser auth --- .dockerignore | 15 + .env.example | 26 +- Dockerfile | 42 ++ README.md | 85 ++- bun.lock | 29 +- docs/authentication.md | 94 +++- docs/client-setup.md | 105 +++- docs/installation.md | 11 - package.json | 9 +- src/auth/cert-forward.ts | 41 ++ src/auth/index.ts | 19 +- src/auth/play-session.ts | 258 ---------- src/client/http.ts | 110 ++-- src/http/config.ts | 295 +++++++++++ src/http/credentials.ts | 251 +++++++++ src/http/fingerprint.ts | 35 ++ src/http/headers.ts | 76 +++ src/http/jsonrpc.ts | 59 +++ src/http/middleware.ts | 63 +++ src/http/rate-limit.ts | 67 +++ src/http/server.ts | 569 +++++++++++++++++++++ src/http/session-manager.ts | 208 ++++++++ src/index.ts | 150 ++---- src/logging.ts | 21 +- src/server-factory.ts | 87 ++++ src/settings.ts | 55 +- tests/unit/auth.test.ts | 285 +---------- tests/unit/cert-forward.test.ts | 47 ++ tests/unit/client-validate-auth.test.ts | 115 +++++ tests/unit/fingerprint.test.ts | 59 +++ tests/unit/http-config.test.ts | 276 ++++++++++ tests/unit/http-credentials.test.ts | 252 +++++++++ tests/unit/http-headers.test.ts | 110 ++++ tests/unit/http-jsonrpc.test.ts | 72 +++ tests/unit/http-middleware.test.ts | 49 ++ tests/unit/http-rate-limit.test.ts | 91 ++++ tests/unit/http-server.integration.test.ts | 299 +++++++++++ tests/unit/http-session-manager.test.ts | 205 ++++++++ tests/unit/logging.test.ts | 92 ++++ tests/unit/server-factory.test.ts | 73 +++ tests/unit/settings.test.ts | 118 ++++- tsup.config.ts | 2 - 42 files changed, 4166 insertions(+), 759 deletions(-) create mode 100644 .dockerignore create mode 100644 Dockerfile create mode 100644 src/auth/cert-forward.ts delete mode 100644 src/auth/play-session.ts create mode 100644 src/http/config.ts create mode 100644 src/http/credentials.ts create mode 100644 src/http/fingerprint.ts create mode 100644 src/http/headers.ts create mode 100644 src/http/jsonrpc.ts create mode 100644 src/http/middleware.ts create mode 100644 src/http/rate-limit.ts create mode 100644 src/http/server.ts create mode 100644 src/http/session-manager.ts create mode 100644 src/server-factory.ts create mode 100644 tests/unit/cert-forward.test.ts create mode 100644 tests/unit/client-validate-auth.test.ts create mode 100644 tests/unit/fingerprint.test.ts create mode 100644 tests/unit/http-config.test.ts create mode 100644 tests/unit/http-credentials.test.ts create mode 100644 tests/unit/http-headers.test.ts create mode 100644 tests/unit/http-jsonrpc.test.ts create mode 100644 tests/unit/http-middleware.test.ts create mode 100644 tests/unit/http-rate-limit.test.ts create mode 100644 tests/unit/http-server.integration.test.ts create mode 100644 tests/unit/http-session-manager.test.ts create mode 100644 tests/unit/logging.test.ts create mode 100644 tests/unit/server-factory.test.ts diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..6ca7819 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,15 @@ +.git +node_modules +dist +coverage +tests +docs +.agents +.claude +.claude-plugin +.codex-plugin +skills +*.log +.env +.env.* +.DS_Store diff --git a/.env.example b/.env.example index e2e3eac..9ab9ace 100644 --- a/.env.example +++ b/.env.example @@ -5,7 +5,7 @@ HORIZON_URL=https://horizon.example.com # === Authentication (auto-detected from which variables are set) === -# Priority: mTLS > API Key > OIDC browser +# Priority: mTLS > API Key (startup fails closed if neither is set) # Option 1: API Key (set both) HORIZON_API_ID= @@ -20,10 +20,6 @@ HORIZON_API_KEY= # HORIZON_CLIENT_PFX=/path/to/client.p12 # HORIZON_CLIENT_PFX_PASSWORD= -# Option 4: OIDC browser session -# Just set HORIZON_URL. A Chromium window opens for login at startup. -# Requires Playwright in the runtime environment (see docs/installation.md). - # DEPRECATED - no longer required, kept for backward compatibility. # The server logs a warning if this is set. # HORIZON_AUTH_MODE= @@ -31,7 +27,6 @@ HORIZON_API_KEY= # === Optional - TLS and timeouts === HORIZON_VERIFY_SSL=true HORIZON_TIMEOUT=30 -HORIZON_LOGIN_TIMEOUT=300 HORIZON_EXPORT_TIMEOUT=120 # === Optional - logging and version compatibility === @@ -41,6 +36,25 @@ HORIZON_LOG_LEVEL=INFO # Comma-separated list of versions that are likely to work but emit a warning. # HORIZON_WARN_VERSIONS=2.7,2.9 +# === Optional - streamable HTTP transport === +# Set HORIZON_TRANSPORT=http to serve over HTTP instead of stdio. One MCP +# instance per Horizon; the backend is always HORIZON_URL above. +# HORIZON_TRANSPORT=http +# HORIZON_HTTP_HOST=127.0.0.1 # 0.0.0.0 only behind a trusted edge +# HORIZON_HTTP_PORT=8080 +# HORIZON_HTTP_PATH=/mcp +# HORIZON_HTTP_AUTH_MODE=service # service | api-key | mtls +# A non-loopback bind requires one of these (else startup fails closed): +# HORIZON_PUBLIC_URL=https://mcp.example.com +# HORIZON_TRUSTED_HOSTS=mcp.example.com +# HORIZON_TRUSTED_ORIGINS=https://app.example.com # only for browser callers +# Inbound mTLS (HORIZON_HTTP_AUTH_MODE=mtls), pick one termination topology: +# HORIZON_HTTP_TLS_CERT=/path/to/listener.crt +# HORIZON_HTTP_TLS_KEY=/path/to/listener.key +# HORIZON_INBOUND_CERT_HEADER=x-forwarded-client-cert +# HORIZON_TRUSTED_PROXY=10.0.0.0/8 +# HORIZON_FORWARD_CERT_HEADER=SSL_CLIENT_CERT + # === Development / testing only (never read by the server itself) === # HORIZON_E2E_URL=https://qa.horizon.example.com # HORIZON_E2E_API_ID= diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..99f4a9f --- /dev/null +++ b/Dockerfile @@ -0,0 +1,42 @@ +# syntax=docker/dockerfile:1 + +# ---- Build stage --------------------------------------------------------- +FROM oven/bun:1 AS build +WORKDIR /app + +COPY package.json bun.lock ./ +RUN bun install --frozen-lockfile + +COPY tsconfig.json tsup.config.ts ./ +COPY src ./src +RUN bun run build + +# Prune dev dependencies so the runtime image only carries production deps. +RUN bun install --frozen-lockfile --production + +# ---- Runtime stage ------------------------------------------------------- +FROM node:24-slim AS runtime +WORKDIR /app +ENV NODE_ENV=production + +COPY --from=build /app/node_modules ./node_modules +COPY --from=build /app/dist ./dist +COPY package.json ./ + +# Streamable HTTP defaults. The operator MUST also provide, at minimum: +# HORIZON_URL the single Horizon backend this instance serves +# HORIZON_HTTP_AUTH_MODE service | api-key | mtls +# HORIZON_TRUSTED_HOSTS or HORIZON_PUBLIC_URL +# binding 0.0.0.0 with neither set fails closed and refuses to start +# plus the credential for the chosen auth mode (see README "Transports"). +# +# Liveness/readiness probes should target /healthz and /readyz. Both are +# Host-validated, so the probe MUST send a Host header that is in +# HORIZON_TRUSTED_HOSTS (or derived from HORIZON_PUBLIC_URL). +ENV HORIZON_TRANSPORT=http \ + HORIZON_HTTP_HOST=0.0.0.0 \ + HORIZON_HTTP_PORT=8080 + +EXPOSE 8080 +USER node +CMD ["node", "dist/index.js"] diff --git a/README.md b/README.md index 86949bc..9499614 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ Most MCP servers hand an LLM a list of tools and leave it to figure out the doma - **211 tools across 12 domains**, each annotated with a safety tier (`read-only`, `mutating-safe`, `mutating-destructive`). - **Knowledge catalog**: 17 core topic URIs, 4 curated playbooks, plus auto-generated section URIs derived from H2 headings of the longest guides. -- **Four authentication modes**: API key, mTLS (PEM), mTLS (PKCS12/PFX), and OIDC browser session (Playwright-driven). +- **Two credential types**: Horizon API key (`X-API-ID` / `X-API-KEY`) and TLS client certificate (PEM or PKCS12/PFX). Usable as a single server identity, or per caller over the HTTP transport. - **HQL helpers**: validators and natural-language translators for HCQL (certificates), HRQL (requests), HEQL (events), and HDQL (discovery events). - **Crypto decoding**: parse X.509, PKCS#10 CSR, PKCS#7, CRL, OCSP, and RFC 3161 timestamp responses to structured JSON without leaving the chat. - **Confirmation safeguards**: every mutating tool emits a STOP confirmation block; destructive tools additionally require an `expected_name` parameter that must match the target object. @@ -24,7 +24,8 @@ Tool counts per domain: | Domain | Tools | Highlights | | ----------------- | ----: | --------------------------------------------------------------------- | -| Assist | 20 | `whoami`, grading, HQL validators, crypto decoders, simulators | +| Configuration | 126 | CA / profile / RBAC / DCV / connector / policy CRUD (Horizon 2.8-2.10)| +| Assist | 21 | `whoami`, grading, HQL validators, crypto decoders, simulators | | Lifecycle | 17 | search/aggregate certs, requests, events, enroll, approve, revoke | | Dashboards | 12 | dashboard CRUD, charts, saved HQL queries | | Datasources | 8 | DNS / LDAP / REST datasources, plus a `test_datasource` dry-run | @@ -42,7 +43,7 @@ Full per-tool table with safety tiers in [docs/tools-reference.md](docs/tools-re - [Bun](https://bun.sh/) 1.x+ (recommended) or Node.js >= 24.10 - An Evertrust Horizon instance (tested on 2.8, expected to work on 2.7 and 2.9) -- API credentials, a client certificate, or browser-based OIDC access to that instance +- API credentials or a client certificate for that instance ## Install @@ -87,7 +88,7 @@ node dist/index.js The server is configured entirely through `HORIZON_*` environment variables. A starter template lives in [.env.example](.env.example); copy it to `.env.local` and adjust. -The server auto-detects the authentication mode based on which variables are set. Priority order: **mTLS > API key > OIDC browser**. +The server auto-detects the authentication mode based on which variables are set. Priority order: **mTLS > API key**. If neither is configured, startup fails closed. ### Connection and authentication @@ -104,14 +105,45 @@ The server auto-detects the authentication mode based on which variables are set | `HORIZON_VERIFY_SSL` | No | `true` | Set to `false` or `0` to skip TLS verification on the Horizon endpoint (development only). | | `HORIZON_ALLOW_PRIVATE_TLS_PROBE` | No | (blocked) | By default `fetch_exposed_certificate` refuses to connect to private/link-local IPs (SSRF guard). Set to `1` to permit probing internal hosts (e.g. `10.x`, `192.168.x`, `127.0.0.1`). | | `HORIZON_TIMEOUT` | No | `30` | HTTP request timeout in seconds for standard API calls. | -| `HORIZON_LOGIN_TIMEOUT` | No | `300` | Timeout in seconds for the OIDC browser login window. | | `HORIZON_EXPORT_TIMEOUT` | No | `120` | Timeout in seconds for CSV exports and other long-running endpoints. | | `HORIZON_LOG_LEVEL` | No | `INFO` | One of `DEBUG`, `INFO`, `WARNING`, `ERROR`. | | `HORIZON_TESTED_VERSIONS` | No | `2.8` | Comma-separated list of Horizon versions known to fully work with this build. | | `HORIZON_WARN_VERSIONS` | No | `2.7,2.9` | Comma-separated list of versions that are likely to work but emit a warning. | | `HORIZON_AUTH_MODE` | DEPRECATED | | No longer required. Kept readable for backward compatibility; setting it logs a warning. | -OIDC browser sessions need no extra variables: when neither API key nor mTLS variables are set, the server launches Playwright Chromium pointed at `HORIZON_URL` and waits for `HORIZON_LOGIN_TIMEOUT` seconds for the user to complete login. +### Streamable HTTP (`HORIZON_TRANSPORT=http`) + +These variables apply only when `HORIZON_TRANSPORT=http`; in stdio mode they are ignored. + +| Var | Default | Notes | +| -------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `HORIZON_TRANSPORT` | `stdio` | `stdio` \| `http` | +| `HORIZON_HTTP_HOST` | `127.0.0.1` | Bind address; `0.0.0.0` only behind a trusted edge. | +| `HORIZON_HTTP_PORT` | `8080` | Bind port. | +| `HORIZON_HTTP_PATH` | `/mcp` | Endpoint path; absolute, no query or fragment; trailing slash normalized. | +| `HORIZON_PUBLIC_URL` | (unset) | Public origin/base URL clients reach the server at; the endpoint is `new URL(HORIZON_HTTP_PATH, HORIZON_PUBLIC_URL)`. | +| `HORIZON_TRUSTED_HOSTS` | derived | Comma list of allowed `Host` values; derived from `HORIZON_PUBLIC_URL` or, on a loopback bind, the loopback hosts. A non-loopback bind with neither set refuses to start. | +| `HORIZON_TRUSTED_ORIGINS` | (unset) | Comma list of allowed CORS origins; unset means any request carrying an `Origin` is rejected (non-browser MCP clients send none). | +| `HORIZON_HTTP_AUTH_MODE` | `service` | `service` \| `api-key` \| `mtls` | +| `HORIZON_SESSION_IDLE_TTL` | `300` | Seconds. | +| `HORIZON_SESSION_ABS_TTL` | `3600` | Seconds. | +| `HORIZON_MAX_SESSIONS` | `256` | Max concurrent sessions. | +| `HORIZON_MAX_INFLIGHT_TOOLCALLS` | `8` | Per-session in-flight tool calls. | +| `HORIZON_MAX_BODY_BYTES` | `1048576` | Max request body bytes (1 MiB). | +| `HORIZON_SSE_MAX_DURATION` | `3600` | Max SSE stream lifetime, seconds. | +| `HORIZON_RATE_LIMIT_RPS` | `20` | Per-session limit, counted per JSON-RPC message per second; `0` disables. | +| `HORIZON_INIT_RATE_LIMIT` | `5` | Pre-session `initialize` attempts per second (global cap and per remote address); `0` disables. | + +Inbound mTLS settings (only when `HORIZON_HTTP_AUTH_MODE=mtls`): + +| Var | Notes | +| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `HORIZON_HTTP_TLS_CERT` / `HORIZON_HTTP_TLS_KEY` | MCP terminates client TLS itself with its own server cert/key (requests a client cert without requiring a trusted CA). | +| `HORIZON_INBOUND_CERT_HEADER` | Alternative: a trusted ingress terminates client TLS and forwards the client cert to the MCP in this header. | +| `HORIZON_TRUSTED_PROXY` | IP/CIDR the inbound cert header is accepted from; REQUIRED with `HORIZON_INBOUND_CERT_HEADER`; matched on the direct TCP socket peer, never `X-Forwarded-For`. | +| `HORIZON_FORWARD_CERT_HEADER` | Horizon-facing header the MCP sets with the captured cert; default `SSL_CLIENT_CERT` to match Horizon's `security.http.headers.certificate`; value is a URL-encoded PEM. | + +`HORIZON_URL` and the existing auth env vars (`HORIZON_API_ID`/`HORIZON_API_KEY`, `HORIZON_CLIENT_CERT`/`HORIZON_CLIENT_KEY`/`HORIZON_CLIENT_PFX`) are unchanged. In per-caller `mtls` mode `HORIZON_URL` must point at the internal Horizon Play backend that trusts the forwarded cert header (bypassing Horizon's own nginx). HTTP mode refuses to start if `HORIZON_ALLOW_PRIVATE_TLS_PROBE=1`. ### Development and testing @@ -124,6 +156,19 @@ These variables are read by the test suite only and never by the server itself: | `HORIZON_E2E_API_KEY` | `bun run test:e2e` | API key secret for E2E tests. | | `HORIZON_LLM_EVAL_MODEL` | `bun run test:llm` | Model identifier used by the LLM evaluation harness. | +## Transports + +The server speaks MCP over one of two transports, selected by `HORIZON_TRANSPORT`. + +- **stdio** (default) - local, single user. The MCP client launches the server as a child process and talks to it over stdin/stdout. The credential comes from the environment the client sets (an API key or mTLS to Horizon). This is the right choice for a developer running the server next to their IDE or chat client. +- **streamable HTTP** (`HORIZON_TRANSPORT=http`) - hosted next to its Horizon, one MCP instance per Horizon. The Horizon URL is always taken from the `HORIZON_URL` environment variable and is never supplied by the client, so there is no multi-tenant routing. A single endpoint (default `/mcp`) serves multiple concurrent client sessions over `POST` / `GET` / `DELETE` with Server-Sent Events (SSE) responses, and each caller's session is isolated. Run a single replica to avoid session affinity; if you must scale out, route on the `Mcp-Session-Id` header so a session always lands on the same replica. + +See [Streamable HTTP](#streamable-http-horizon_transporthttp) for the full HTTP configuration and [Authentication modes](#authentication-modes) for how callers are identified in HTTP mode. + +### Hosting + +Deploy one MCP per Horizon, co-located so the MCP-to-Horizon hop stays internal. Reuse Horizon's existing edge (its TLS termination and access control) for the client-to-MCP path rather than exposing the MCP unauthenticated, and pull secrets from your orchestrator's secret store. The server exposes `/healthz` (liveness) and `/readyz` (readiness) endpoints for container probes. + ## MCP client setup The binary name shipped by this package is **`horizon-mcp`** (declared in `package.json` `bin`). Use that exact name in every client configuration; do not call it `horizon-mcp-server`. @@ -176,16 +221,22 @@ For Codex, OpenCode, and MCP Inspector configurations, see [docs/client-setup.md ## Authentication modes -- **API key** - the recommended mode for headless or service-account use. Issue an API identity in Horizon, set `HORIZON_API_ID` and `HORIZON_API_KEY`, and the server signs every request with those credentials. -- **Mutual TLS (PEM)** - use when your Horizon instance enforces client certificates and you already have separate cert and key files. Set `HORIZON_CLIENT_CERT`, `HORIZON_CLIENT_KEY`, and optionally `HORIZON_CLIENT_KEY_PASSWORD`. -- **Mutual TLS (PKCS12 / PFX)** - same as above but using a combined `.p12` / `.pfx` bundle. Set `HORIZON_CLIENT_PFX` and optionally `HORIZON_CLIENT_PFX_PASSWORD`. -- **OIDC browser session** - useful for human operators who already have SSO. Set only `HORIZON_URL` and install Playwright Chromium (`bun install playwright && bunx playwright install chromium`); the server opens a browser window at startup and captures the `PLAY_SESSION` cookie once login completes. +The MCP supports exactly two credential types against Horizon: a **Horizon API key** (`X-API-ID` / `X-API-KEY`) and a **TLS client certificate** (supplied as PEM or PKCS12 / PFX, see the [Connection and authentication](#connection-and-authentication) table). The MCP never makes authorization decisions of its own: it forwards a Horizon credential and Horizon applies that principal's RBAC. + +In stdio mode the credential comes from the environment. In streamable HTTP mode, `HORIZON_HTTP_AUTH_MODE` selects how each caller's identity is established: + +- **`service`** - the MCP holds one env credential (an API key or mTLS to Horizon) and acts as a single identity for every caller; clients send only the URL. The anti-hijack session fingerprint does not apply in this mode (`Mcp-Session-Id` behaves as a bearer), so the front door must be access-controlled by network placement or an authenticating edge; use a least-privileged identity. +- **`api-key`** (per-caller) - the client sends its own `X-API-ID` / `X-API-KEY`, which the MCP forwards to Horizon. This forwards a long-lived secret through the MCP. +- **`mtls`** (per-caller, terminate-and-forward) - the client presents a TLS client certificate; the MCP (or a trusted ingress) terminates the TLS with `optional_no_ca` semantics (proving possession, not validating the chain) and forwards the certificate to Horizon's Play backend in `HORIZON_FORWARD_CERT_HEADER`. Horizon validates the chain, revocation, and identity. No long-lived secret is forwarded. Most MCP clients cannot present a client certificate, so a local mTLS proxy on the client side is usually needed (see [docs/client-setup.md](docs/client-setup.md)). + +> [!IMPORTANT] +> **Breaking change** - OIDC browser login (Playwright) has been **removed** in all transports, stdio included. Users who relied on it must switch to an API key or mTLS. A headless OIDC bearer token is deferred until Horizon supports a forwardable token. See [docs/authentication.md](docs/authentication.md) for the full step-by-step guide and troubleshooting tips. ## Tool catalog overview -The 84 tools are grouped into 11 domains. Each tool ships with explicit "use when / do not use when" guidance for smaller models. The table at the top of this README lists tool counts; [docs/tools-reference.md](docs/tools-reference.md) has the full per-tool table with safety tiers and one-line descriptions. +The 211 tools are grouped into 12 domains. Each tool ships with explicit "use when / do not use when" guidance for smaller models. The table at the top of this README lists tool counts; [docs/tools-reference.md](docs/tools-reference.md) has the full per-tool table with safety tiers and one-line descriptions. Knowledge resources are exposed at `horizon://knowledge/*` URIs. See [docs/knowledge-resources.md](docs/knowledge-resources.md) for the full catalog. @@ -288,7 +339,7 @@ bun run build:binaries # -> dist/horizon-mcp-{darwin,linux,windows}-{x64,arm64}[.exe] ``` -Both scripts pass `--external playwright` (and `--external chromium-bidi --external electron` for the cross-compile target) so the resulting binaries do not embed Playwright. If you plan to use OIDC browser auth, install Playwright separately in the runtime environment. +The standalone binaries bundle everything needed to run; no extra runtime dependencies are required. ## Development @@ -334,12 +385,10 @@ See [docs/development.md](docs/development.md) for environment setup, fixture ma ## Troubleshooting -- **`HORIZON_API_ID and HORIZON_API_KEY must both be set`** - exactly one auth mode must be fully configured. Either provide both API key variables, both mTLS variables (cert+key or pfx), or neither (for OIDC). +- **`No Horizon credentials configured`** - exactly one auth mode must be fully configured. Provide both API key variables (`HORIZON_API_ID` + `HORIZON_API_KEY`) or the mTLS variables (cert+key, or pfx). Startup fails closed if neither is set. - **TLS handshake failures** - check `HORIZON_URL` uses `https://`, that the Horizon CA is trusted by your system store, and (for development only) that `HORIZON_VERIFY_SSL=false` is honoured. - **`HQL-001` parse errors** - HQL field names are lowercase (`contactemail`, not `contactEmail`). The two exceptions are `groupBy` and `sortedBy`, which are camelCase because they are API parameters rather than query fields. See `horizon://knowledge/query-languages`. -- **Missing CSRF token in OIDC mode** - if you see CSRF errors after a long browser session, restart the server so it can reopen Chromium and capture a fresh `csrf-token` cookie alongside `PLAY_SESSION`. - **Version compatibility warnings** - the server logs a warning when the connected Horizon version is in `HORIZON_WARN_VERSIONS`. Functionality is best-effort on those versions; promote to `HORIZON_TESTED_VERSIONS` only after running your own E2E suite. -- **`Chromium browser not found` for OIDC** - run `bunx playwright install chromium` (or `npx playwright install chromium`) inside the environment where the server runs. ## Compatibility @@ -387,10 +436,10 @@ PRs welcome. Before opening a pull request, run `bun run validate:ci` (it runs f | Document | Contents | | ------------------------------------------------- | ------------------------------------------------------------------------------ | -| [Installation](docs/installation.md) | Install methods, OIDC setup, troubleshooting | -| [Authentication](docs/authentication.md) | All four auth modes with environment variable reference | +| [Installation](docs/installation.md) | Install methods and troubleshooting | +| [Authentication](docs/authentication.md) | Supported credential types with environment variable reference | | [Client setup](docs/client-setup.md) | Claude Desktop, Claude Code, Cursor, Codex, OpenCode, MCP Inspector | -| [Tool reference](docs/tools-reference.md) | All 84 tools by domain with safety tiers | +| [Tool reference](docs/tools-reference.md) | All 211 tools by domain with safety tiers | | [Knowledge resources](docs/knowledge-resources.md)| 17 core URIs, 4 curated playbooks, generated section resources | | [Development](docs/development.md) | Dev setup, tests, linting | diff --git a/bun.lock b/bun.lock index 440a94e..7eb69f6 100644 --- a/bun.lock +++ b/bun.lock @@ -6,6 +6,7 @@ "name": "horizon-mcp-server", "dependencies": { "@modelcontextprotocol/sdk": "1.29.0", + "express": "^5", "undici": "8.0.1", "zod": "4.3.6", }, @@ -19,6 +20,7 @@ "@semantic-release/github": "^12.0.6", "@semantic-release/npm": "^13.1.5", "@trivago/prettier-plugin-sort-imports": "6.0.2", + "@types/express": "^5", "@types/node": "25.5.2", "eslint": "10.1.0", "eslint-config-prettier": "10.1.8", @@ -33,9 +35,6 @@ "typescript-eslint": "8.58.0", "vitest": "4.1.2", }, - "optionalDependencies": { - "playwright": "1.59.1", - }, }, }, "overrides": { @@ -325,20 +324,38 @@ "@trivago/prettier-plugin-sort-imports": ["@trivago/prettier-plugin-sort-imports@6.0.2", "", { "dependencies": { "@babel/generator": "^7.28.0", "@babel/parser": "^7.28.0", "@babel/traverse": "^7.28.0", "@babel/types": "^7.28.0", "javascript-natural-sort": "^0.7.1", "lodash-es": "^4.17.21", "minimatch": "^9.0.0", "parse-imports-exports": "^0.2.4" }, "peerDependencies": { "@vue/compiler-sfc": "3.x", "prettier": "2.x - 3.x", "prettier-plugin-ember-template-tag": ">= 2.0.0", "prettier-plugin-svelte": "3.x", "svelte": "4.x || 5.x" }, "optionalPeers": ["@vue/compiler-sfc", "prettier-plugin-ember-template-tag", "prettier-plugin-svelte", "svelte"] }, "sha512-3DgfkukFyC/sE/VuYjaUUWoFfuVjPK55vOFDsxD56XXynFMCZDYFogH2l/hDfOsQAm1myoU/1xByJ3tWqtulXA=="], + "@types/body-parser": ["@types/body-parser@1.19.6", "", { "dependencies": { "@types/connect": "*", "@types/node": "*" } }, "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g=="], + "@types/chai": ["@types/chai@5.2.3", "", { "dependencies": { "@types/deep-eql": "*", "assertion-error": "^2.0.1" } }, "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA=="], + "@types/connect": ["@types/connect@3.4.38", "", { "dependencies": { "@types/node": "*" } }, "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug=="], + "@types/deep-eql": ["@types/deep-eql@4.0.2", "", {}, "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw=="], "@types/esrecurse": ["@types/esrecurse@4.3.1", "", {}, "sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw=="], "@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="], + "@types/express": ["@types/express@5.0.6", "", { "dependencies": { "@types/body-parser": "*", "@types/express-serve-static-core": "^5.0.0", "@types/serve-static": "^2" } }, "sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA=="], + + "@types/express-serve-static-core": ["@types/express-serve-static-core@5.1.1", "", { "dependencies": { "@types/node": "*", "@types/qs": "*", "@types/range-parser": "*", "@types/send": "*" } }, "sha512-v4zIMr/cX7/d2BpAEX3KNKL/JrT1s43s96lLvvdTmza1oEvDudCqK9aF/djc/SWgy8Yh0h30TZx5VpzqFCxk5A=="], + + "@types/http-errors": ["@types/http-errors@2.0.5", "", {}, "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg=="], + "@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="], "@types/node": ["@types/node@25.5.2", "", { "dependencies": { "undici-types": "~7.18.0" } }, "sha512-tO4ZIRKNC+MDWV4qKVZe3Ql/woTnmHDr5JD8UI5hn2pwBrHEwOEMZK7WlNb5RKB6EoJ02gwmQS9OrjuFnZYdpg=="], "@types/normalize-package-data": ["@types/normalize-package-data@2.4.4", "", {}, "sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA=="], + "@types/qs": ["@types/qs@6.15.1", "", {}, "sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw=="], + + "@types/range-parser": ["@types/range-parser@1.2.7", "", {}, "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ=="], + + "@types/send": ["@types/send@1.2.1", "", { "dependencies": { "@types/node": "*" } }, "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ=="], + + "@types/serve-static": ["@types/serve-static@2.2.0", "", { "dependencies": { "@types/http-errors": "*", "@types/node": "*" } }, "sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ=="], + "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.58.0", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.58.0", "@typescript-eslint/type-utils": "8.58.0", "@typescript-eslint/utils": "8.58.0", "@typescript-eslint/visitor-keys": "8.58.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.58.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-RLkVSiNuUP1C2ROIWfqX+YcUfLaSnxGE/8M+Y57lopVwg9VTYYfhuz15Yf1IzCKgZj6/rIbYTmJCUSqr76r0Wg=="], "@typescript-eslint/parser": ["@typescript-eslint/parser@8.58.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.58.0", "@typescript-eslint/types": "8.58.0", "@typescript-eslint/typescript-estree": "8.58.0", "@typescript-eslint/visitor-keys": "8.58.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-rLoGZIf9afaRBYsPUMtvkDWykwXwUPL60HebR4JgTI8mxfFe2cQTu3AGitANp4b9B2QlVru6WzjgB2IzJKiCSA=="], @@ -949,10 +966,6 @@ "pkg-types": ["pkg-types@1.3.1", "", { "dependencies": { "confbox": "^0.1.8", "mlly": "^1.7.4", "pathe": "^2.0.1" } }, "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ=="], - "playwright": ["playwright@1.59.1", "", { "dependencies": { "playwright-core": "1.59.1" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": "cli.js" }, "sha512-C8oWjPR3F81yljW9o5OxcWzfh6avkVwDD2VYdwIGqTkl+OGFISgypqzfu7dOe4QNLL2aqcWBmI3PMtLIK233lw=="], - - "playwright-core": ["playwright-core@1.59.1", "", { "bin": "cli.js" }, "sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg=="], - "postcss": ["postcss@8.5.8", "", { "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg=="], "postcss-load-config": ["postcss-load-config@6.0.1", "", { "dependencies": { "lilconfig": "^3.1.1" }, "peerDependencies": { "jiti": ">=1.21.0", "postcss": ">=8.0.9", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["jiti", "yaml"] }, "sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g=="], @@ -1563,8 +1576,6 @@ "pkg-conf/find-up": ["find-up@2.1.0", "", { "dependencies": { "locate-path": "^2.0.0" } }, "sha512-NWzkk0jSJtTt08+FBFMvXoeZnOJD+jTtsRmBYbAIzJdX6l7dLgR7CTubCM5/eDdPUBvLCeVasP1brfVR/9/EZQ=="], - "playwright/fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="], - "restore-cursor/onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="], "restore-cursor/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="], diff --git a/docs/authentication.md b/docs/authentication.md index 16ae649..3c2a502 100644 --- a/docs/authentication.md +++ b/docs/authentication.md @@ -1,10 +1,24 @@ # Authentication -Four authentication modes are supported. The server auto-detects which mode to use based on which environment variables are set. +Two Horizon credential types are supported: a **Horizon API key** and a **TLS client certificate**. Each can be used in one of two ways: -**Priority:** mTLS > API Key > OIDC browser +- as a **server credential** (an environment variable), where the MCP authenticates to Horizon as one fixed identity for every caller, or +- as a **per-caller credential** (HTTP transport only), where the client supplies its own credential and the MCP forwards it to Horizon on that caller's behalf. -## Mode 1: API Key +**The MCP never makes authorization decisions.** It only forwards a Horizon credential; Horizon resolves that credential to a principal and applies that principal's RBAC. Whatever the caller can do in Horizon is exactly what they can do through the MCP. + +| Credential type | Server credential (env) | Per-caller credential (HTTP) | +|-----------------|-------------------------|------------------------------| +| Horizon API key | `HORIZON_API_ID` / `HORIZON_API_KEY` | `HORIZON_HTTP_AUTH_MODE=api-key` | +| TLS client certificate | `HORIZON_CLIENT_CERT` + `HORIZON_CLIENT_KEY`, or `HORIZON_CLIENT_PFX` | `HORIZON_HTTP_AUTH_MODE=mtls` | + +## Server credentials (stdio and HTTP service mode) + +These are the credentials the MCP uses to authenticate as a single identity. They apply to the stdio transport and to the HTTP transport's default `service` mode. The server auto-detects which credential to use from the environment variables that are set. + +**Priority:** mTLS (client certificate) > API key. Setting both `HORIZON_CLIENT_CERT` and `HORIZON_CLIENT_PFX` is an error. + +### API key ```bash HORIZON_URL=https://horizon.example.com @@ -12,7 +26,9 @@ HORIZON_API_ID=your-api-id HORIZON_API_KEY=your-api-key ``` -## Mode 2: Mutual TLS (PEM files) +The MCP sends `X-API-ID` / `X-API-KEY` to Horizon as that one identity. + +### Mutual TLS (PEM files) ```bash HORIZON_URL=https://horizon.example.com @@ -21,7 +37,9 @@ HORIZON_CLIENT_KEY=/path/to/client.key HORIZON_CLIENT_KEY_PASSWORD=optional-key-password # omit if key is unencrypted ``` -## Mode 3: Mutual TLS (PKCS12 / PFX) +The MCP performs a real mTLS handshake to Horizon as that identity. + +### Mutual TLS (PKCS12 / PFX) ```bash HORIZON_URL=https://horizon.example.com @@ -29,35 +47,77 @@ HORIZON_CLIENT_PFX=/path/to/client.p12 HORIZON_CLIENT_PFX_PASSWORD=optional-pfx-password # omit if bundle is unencrypted ``` -## Mode 4: OIDC browser session +## Per-caller credentials (HTTP transport) + +When the server runs the streamable HTTP transport (`HORIZON_TRANSPORT=http`), `HORIZON_HTTP_AUTH_MODE` selects how each caller is authenticated: + +| `HORIZON_HTTP_AUTH_MODE` | Behaviour | +|--------------------------|-----------| +| `service` (default) | The MCP uses its own server credential (above) for every caller. Client-supplied credential headers and client certificates are rejected. | +| `api-key` | Each caller sends its own `X-API-ID` / `X-API-KEY`; the MCP forwards them to Horizon. | +| `mtls` | Each caller presents a TLS client certificate; the MCP forwards it to Horizon (terminate-and-forward, below). | -Set only `HORIZON_URL`. A browser window opens for interactive login at startup. Requires Playwright: +### `api-key` (forward the caller's API key) ```bash -bun install playwright -bunx playwright install chromium +HORIZON_TRANSPORT=http +HORIZON_HTTP_AUTH_MODE=api-key ``` -Then configure with just the URL: +The client sends its own `X-API-ID` / `X-API-KEY` headers and the MCP forwards them to Horizon. Be aware that this forwards a long-lived secret through the MCP: the caller's API key transits the MCP process on every request. + +### `mtls` (terminate-and-forward) ```bash -HORIZON_URL=https://horizon.example.com +HORIZON_TRANSPORT=http +HORIZON_HTTP_AUTH_MODE=mtls +# Either the MCP terminates client TLS itself: +HORIZON_HTTP_TLS_CERT=/path/to/listener.crt +HORIZON_HTTP_TLS_KEY=/path/to/listener.key +# ...or a trusted ingress terminates it and forwards the captured cert header: +HORIZON_INBOUND_CERT_HEADER=ssl-client-cert +HORIZON_TRUSTED_PROXY=10.0.0.0/24 +# Header used to forward the cert to Horizon's Play backend: +HORIZON_FORWARD_CERT_HEADER=SSL_CLIENT_CERT # default ``` +How it works: + +1. The client presents a TLS client certificate. The MCP (or a trusted ingress in front of it) terminates the client TLS with `optional_no_ca` semantics (Node `requestCert: true`, `rejectUnauthorized: false`). This proves the client holds the certificate's private key **without** validating the issuing CA. +2. The MCP forwards the certificate to Horizon's Play backend in the `HORIZON_FORWARD_CERT_HEADER` (default `SSL_CLIENT_CERT`, matching Horizon's `security.http.headers.certificate` config) as a URL-encoded PEM. +3. Horizon validates the chain, checks revocation, and maps the certificate to an identity. + +The MCP strips any client-supplied copy of the forward header, so only the possession-verified certificate is ever forwarded. Trust between the MCP and Horizon's Play backend is established by network isolation, not by a shared secret. Note that most MCP clients cannot present a client certificate directly, so a local mTLS proxy on the client side is usually needed. + +## Removed: OIDC browser login + +The OIDC browser login flow (Playwright) has been **removed entirely**, in every transport including stdio. This is a breaking change. Deployments that relied on browser login must switch to an API key or a TLS client certificate. `HORIZON_AUTH_MODE` is deprecated and ignored; the auth mode is now derived from the credentials that are present. + +## Future: headless OIDC bearer token + +A headless OIDC bearer token is deferred to future work. It is blocked until Horizon supports a forwardable, API-validatable token. Once it does, the MCP will forward an `Authorization: Bearer` credential the same way it forwards an API key or a client certificate today. + ## Configuration reference | Variable | Required | Default | Description | |----------|----------|---------|-------------| | `HORIZON_URL` | Yes | `https://localhost` | Horizon instance URL | -| `HORIZON_API_ID` | Mode 1 | | API key identifier | -| `HORIZON_API_KEY` | Mode 1 | | API key secret | -| `HORIZON_CLIENT_CERT` | Mode 2 | | Path to PEM client certificate | -| `HORIZON_CLIENT_KEY` | Mode 2 | | Path to PEM private key | +| `HORIZON_API_ID` | API key | | API key identifier (server credential) | +| `HORIZON_API_KEY` | API key | | API key secret (server credential) | +| `HORIZON_CLIENT_CERT` | mTLS (PEM) | | Path to PEM client certificate | +| `HORIZON_CLIENT_KEY` | mTLS (PEM) | | Path to PEM private key | | `HORIZON_CLIENT_KEY_PASSWORD` | No | | PEM key decryption password | -| `HORIZON_CLIENT_PFX` | Mode 3 | | Path to PKCS12 / PFX bundle | +| `HORIZON_CLIENT_PFX` | mTLS (PFX) | | Path to PKCS12 / PFX bundle | | `HORIZON_CLIENT_PFX_PASSWORD` | No | | PFX decryption password | +| `HORIZON_TRANSPORT` | No | `stdio` | Transport: `stdio` or `http` | +| `HORIZON_HTTP_AUTH_MODE` | No | `service` | HTTP per-caller mode: `service`, `api-key`, or `mtls` | +| `HORIZON_HTTP_TLS_CERT` | mTLS listener | | Listener cert when the MCP terminates client TLS itself | +| `HORIZON_HTTP_TLS_KEY` | mTLS listener | | Listener key (paired with `HORIZON_HTTP_TLS_CERT`) | +| `HORIZON_INBOUND_CERT_HEADER` | mTLS ingress | | Header a trusted ingress uses to forward the captured client cert | +| `HORIZON_TRUSTED_PROXY` | mTLS ingress | | IP or CIDR allowed to present the inbound cert header (required with `HORIZON_INBOUND_CERT_HEADER`) | +| `HORIZON_FORWARD_CERT_HEADER` | No | `SSL_CLIENT_CERT` | Header the MCP sets on the Horizon-facing request to carry the client cert | | `HORIZON_VERIFY_SSL` | No | `true` | Verify server TLS certificates | -| `HORIZON_ALLOW_PRIVATE_TLS_PROBE` | No | (blocked) | `fetch_exposed_certificate` blocks private/link-local IPs (SSRF guard); set to `1` to allow probing internal hosts | +| `HORIZON_ALLOW_PRIVATE_TLS_PROBE` | No | (blocked) | `fetch_exposed_certificate` blocks private/link-local IPs (SSRF guard); set to `1` to allow probing internal hosts. Rejected in HTTP mode. | | `HORIZON_TIMEOUT` | No | `30` | HTTP request timeout (seconds) | | `HORIZON_LOG_LEVEL` | No | `INFO` | Log verbosity: `DEBUG`, `INFO`, `WARNING`, `ERROR` | diff --git a/docs/client-setup.md b/docs/client-setup.md index 1937b9f..d4785c1 100644 --- a/docs/client-setup.md +++ b/docs/client-setup.md @@ -78,7 +78,7 @@ Or with the standalone binary: } ``` -Start Claude Code from that directory. The 84 tools are available immediately. +Start Claude Code from that directory. The 211 tools are available immediately. ## Cursor @@ -218,4 +218,105 @@ export HORIZON_API_KEY=your-api-key bunx @modelcontextprotocol/inspector bunx @evertrust/horizon-mcp ``` -Opens a browser UI showing all 84 tools and the full knowledge resource catalog (17 core URIs + 4 curated playbooks + generated section URIs). +Opens a browser UI showing all 211 tools and the full knowledge resource catalog (17 core URIs + 4 curated playbooks + generated section URIs). + +## Connecting over streamable HTTP (remote server) + +The examples above launch horizon-mcp as a local subprocess over stdio. The server can also run as a long-lived process that speaks the MCP **streamable HTTP** transport, so clients connect to it over the network instead of spawning it. This is the right setup when the server is shared, runs in a container, or sits behind a gateway. + +The server endpoint is `HORIZON_PUBLIC_URL` joined with `HORIZON_HTTP_PATH` (default `/mcp`), for example: + +``` +https://horizon.example.com/mcp +``` + +The server decides how callers authenticate via `HORIZON_HTTP_AUTH_MODE`: + +- `service` - the server holds a single set of Horizon credentials. Callers send no credentials of their own; the client needs only the url. +- `api-key` - each caller authenticates per-request with the `X-API-ID` and `X-API-KEY` HTTP headers. +- `mtls` - each caller authenticates by presenting a TLS client certificate on the connection. + +(OIDC browser login has been removed; use one of the three modes above.) + +These map onto three distinct client capabilities, and MCP clients differ in which they support: + +1. **Connecting to a remote url** - native in Claude Code, Cursor, Codex CLI, OpenCode, MCP Inspector (CLI), and Claude Desktop's connector. This is all that `service` mode needs. +2. **Sending custom request headers** - additionally required for `api-key` mode (the `X-API-ID` and `X-API-KEY` headers). Supported directly by some clients; for the rest, inject the headers with a local proxy (see below). +3. **Presenting a TLS client certificate** - required for `mtls` mode. Most MCP clients cannot do this directly; see the per-caller mTLS subsection for the local-proxy workaround. + +### Claude Code + +Use the HTTP transport form in `.mcp.json` instead of `command`/`args`. For `service` mode the url is all you need: + +```json +{ + "mcpServers": { + "horizon": { + "type": "http", + "url": "https://horizon.example.com/mcp" + } + } +} +``` + +For `api-key` mode, add the `X-API-ID` and `X-API-KEY` headers: + +```json +{ + "mcpServers": { + "horizon": { + "type": "http", + "url": "https://horizon.example.com/mcp", + "headers": { + "X-API-ID": "your-api-id", + "X-API-KEY": "your-api-key" + } + } + } +} +``` + +### Claude Desktop + +Claude Desktop's local config file (`claude_desktop_config.json`) launches stdio servers only. To reach a remote HTTP server, add it as a custom connector: open **Settings > Connectors > Add custom connector** and paste the server url: + +``` +https://horizon.example.com/mcp +``` + +That covers `service` mode, where the url is all the client needs (no credentials). The connector UI does not expose arbitrary static request headers, so for `api-key` mode point the connector at a local proxy that injects `X-API-ID` and `X-API-KEY` on the upstream request (same pattern as the mTLS workaround below). + +### Codex (CLI and Desktop app) + +In `~/.codex/config.toml`, give the server a `url` instead of a `command`. For `service` mode: + +```toml +[mcp_servers.horizon] +url = "https://horizon.example.com/mcp" +``` + +For `api-key` mode the client must attach `X-API-ID` and `X-API-KEY` to each request. If your Codex version supports static request headers for remote MCP servers, set them there; otherwise point `url` at a local proxy that injects the headers (see below). In the **Codex Desktop app**, the same remote server can be added through **Settings > MCP** by entering the url. + +### Per-caller mTLS: local proxy workaround + +When the server runs with `HORIZON_HTTP_AUTH_MODE=mtls`, each caller must present a TLS **client** certificate to the MCP server. Most MCP clients (Claude Code, Claude Desktop, Codex, and others) cannot attach a client certificate to their outbound HTTPS connection. This is a current limitation of the clients, not of the server. + +The workaround is to run a small **mTLS proxy** on the client machine: + +- The MCP client speaks plain MCP over HTTP to the proxy on localhost, for example `http://127.0.0.1:8081/mcp`. +- The proxy opens the upstream TLS connection to the real server (`https://horizon.example.com/mcp`) and presents the client certificate and private key on that connection. + +So the client config simply points at the loopback address instead of the server. For Claude Code: + +```json +{ + "mcpServers": { + "horizon": { + "type": "http", + "url": "http://127.0.0.1:8081/mcp" + } + } +} +``` + +Any TLS-terminating local proxy that can present a client certificate works here (for example stunnel, an nginx/Envoy stream proxy, or a purpose-built mTLS forwarder). The proxy holds the certificate and key; the MCP client stays unaware of them. The same loopback-proxy pattern also serves clients that cannot set custom request headers: have the proxy add `X-API-ID` and `X-API-KEY` for `api-key` mode. diff --git a/docs/installation.md b/docs/installation.md index c72df99..2749aee 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -51,17 +51,6 @@ chmod +x horizon-mcp Binaries are published for macOS (x64/arm64), Linux (x64/arm64), and Windows (x64). -## OIDC browser authentication (optional) - -For OIDC browser-based login, install Playwright and its Chromium browser: - -```bash -bun install playwright -bunx playwright install chromium -``` - -The standalone binaries are built with `--external playwright`, so Playwright must be present in the environment where the server actually runs. - ## Next steps - [Authentication](authentication.md) - configure how the server connects to Horizon diff --git a/package.json b/package.json index a8c533c..29f6a9e 100644 --- a/package.json +++ b/package.json @@ -22,8 +22,8 @@ "scripts": { "dev": "tsx src/index.ts", "build": "tsup", - "build:binary": "bun run build && bun build --compile dist/index.js --outfile dist/horizon-mcp --external playwright", - "build:binaries": "bun run build && bun build --compile dist/index.js --outfile dist/horizon-mcp-linux-x64 --target=bun-linux-x64 --external playwright --external chromium-bidi --external electron && bun build --compile dist/index.js --outfile dist/horizon-mcp-linux-arm64 --target=bun-linux-arm64 --external playwright --external chromium-bidi --external electron && bun build --compile dist/index.js --outfile dist/horizon-mcp-darwin-x64 --target=bun-darwin-x64 --external playwright --external chromium-bidi --external electron && bun build --compile dist/index.js --outfile dist/horizon-mcp-darwin-arm64 --target=bun-darwin-arm64 --external playwright --external chromium-bidi --external electron && bun build --compile dist/index.js --outfile dist/horizon-mcp-windows-x64.exe --target=bun-windows-x64 --external playwright --external chromium-bidi --external electron", + "build:binary": "bun run build && bun build --compile dist/index.js --outfile dist/horizon-mcp", + "build:binaries": "bun run build && bun build --compile dist/index.js --outfile dist/horizon-mcp-linux-x64 --target=bun-linux-x64 && bun build --compile dist/index.js --outfile dist/horizon-mcp-linux-arm64 --target=bun-linux-arm64 && bun build --compile dist/index.js --outfile dist/horizon-mcp-darwin-x64 --target=bun-darwin-x64 && bun build --compile dist/index.js --outfile dist/horizon-mcp-darwin-arm64 --target=bun-darwin-arm64 && bun build --compile dist/index.js --outfile dist/horizon-mcp-windows-x64.exe --target=bun-windows-x64", "test": "vitest run", "test:e2e": "vitest run --config vitest.config.e2e.ts --reporter=verbose", "test:e2e:smoke": "vitest run --config vitest.config.e2e.ts tests/e2e/docs.test.ts --reporter=verbose && vitest run --config vitest.config.e2e.ts tests/e2e/horizon.test.ts -t \"exports events as CSV\" --reporter=verbose", @@ -43,12 +43,10 @@ }, "dependencies": { "@modelcontextprotocol/sdk": "1.29.0", + "express": "^5", "undici": "8.0.1", "zod": "4.3.6" }, - "optionalDependencies": { - "playwright": "1.59.1" - }, "overrides": { "@hono/node-server": "^1.19.13", "fast-uri": "^3.1.2" @@ -63,6 +61,7 @@ "@semantic-release/github": "^12.0.6", "@semantic-release/npm": "^13.1.5", "@trivago/prettier-plugin-sort-imports": "6.0.2", + "@types/express": "^5", "@types/node": "25.5.2", "eslint": "10.1.0", "eslint-config-prettier": "10.1.8", diff --git a/src/auth/cert-forward.ts b/src/auth/cert-forward.ts new file mode 100644 index 0000000..aa399ff --- /dev/null +++ b/src/auth/cert-forward.ts @@ -0,0 +1,41 @@ +import { AuthProvider } from './base.js'; + +/** + * Per-caller mTLS "terminate-and-forward" auth. + * + * The MCP terminated the caller's TLS (or a trusted ingress did) and captured + * the client certificate. This provider relays that certificate to Horizon's + * Play backend in the configured header, exactly as Horizon's own nginx + * ingress does for its native mTLS path. The MCP proves possession at TLS + * termination; Horizon validates the chain, revocation, and identity. + * + * The value is a URL-encoded PEM, mirroring nginx's `$ssl_client_escaped_cert` + * - one of the encodings Horizon's `WithX509Authentication.getCertificate` + * accepts. No client certificate is presented on the MCP->Horizon hop itself + * (the cert travels as a header), so `getDispatcherOptions` stays undefined. + */ +export class CertForwardAuthProvider extends AuthProvider { + private readonly _headerName: string; + private readonly _encodedCert: string; + + constructor(forwardHeader: string, certPem: string) { + super(); + if (!certPem.includes('BEGIN CERTIFICATE')) { + throw new Error( + 'CertForwardAuthProvider requires a PEM certificate (got a value ' + + 'without a BEGIN CERTIFICATE marker).', + ); + } + this._headerName = forwardHeader; + this._encodedCert = encodeURIComponent(certPem); + } + + async getHeaders(): Promise> { + return { [this._headerName]: this._encodedCert }; + } + + async refreshIfNeeded(): Promise { + // The certificate is captured once at session initialize - nothing to + // refresh for the session's lifetime. + } +} diff --git a/src/auth/index.ts b/src/auth/index.ts index b9dfe3a..393dd0f 100644 --- a/src/auth/index.ts +++ b/src/auth/index.ts @@ -3,13 +3,15 @@ import type { HorizonSettings } from '../settings.js'; import { ApiKeyAuthProvider } from './apikey.js'; import { AuthProvider } from './base.js'; import { MtlsAuthProvider } from './mtls.js'; -import { PlaySessionAuthProvider } from './play-session.js'; const logger = getLogger('horizon_mcp.auth'); /** * Factory: auto-detect auth mode from which env vars are set. - * Priority: mTLS (client cert) > API Key > OIDC browser session. + * Priority: mTLS (client cert) > API Key. + * + * OIDC browser (Playwright) login was removed in all transports. Configure + * an API key or an mTLS client certificate instead. */ export function createAuthProvider(settings: HorizonSettings): AuthProvider { if (settings.authMode) { @@ -47,16 +49,15 @@ export function createAuthProvider(settings: HorizonSettings): AuthProvider { return new ApiKeyAuthProvider(settings.apiId, settings.apiKey); } - // Priority 3: Play Session browser login (fallback) - logger.info('Auth mode: Play Session (browser login)'); - return new PlaySessionAuthProvider( - settings.url, - settings.verifySsl, - settings.loginTimeout, + // No credentials: fail closed. OIDC browser login has been removed. + throw new Error( + 'No Horizon credentials configured. Set HORIZON_API_ID and ' + + 'HORIZON_API_KEY for API key auth, or HORIZON_CLIENT_CERT and ' + + 'HORIZON_CLIENT_KEY (or HORIZON_CLIENT_PFX) for mTLS. OIDC browser ' + + 'login is no longer supported.', ); } export { AuthProvider } from './base.js'; export { ApiKeyAuthProvider } from './apikey.js'; export { MtlsAuthProvider } from './mtls.js'; -export { PlaySessionAuthProvider } from './play-session.js'; diff --git a/src/auth/play-session.ts b/src/auth/play-session.ts deleted file mode 100644 index 927104e..0000000 --- a/src/auth/play-session.ts +++ /dev/null @@ -1,258 +0,0 @@ -import { getLogger } from '../logging.js'; -import { AuthProvider } from './base.js'; - -const logger = getLogger('horizon_mcp.auth.play_session'); - -const DEFAULT_LOGIN_TIMEOUT_S = 300; -const MAX_OIDC_RETRIES = 3; - -class OidcFlowError extends Error { - constructor(message: string) { - super(message); - this.name = 'OidcFlowError'; - } -} - -/** - * Authenticate by capturing a PLAY_SESSION cookie from browser login. - * - * Opens a Chromium window pointed at the Horizon URL. The user completes - * login via whatever IdP Horizon is configured with (OIDC, LDAP, etc.). - * Once the PLAY_SESSION cookie appears (or changes from its pre-auth - * value), it's captured and injected into all subsequent API calls. - * - * For OIDC flows with PKCE, handles code verifier expiry by retrying - - * the first attempt caches IdP SSO cookies, and the retry completes - * near-instantly via SSO. - */ -export class PlaySessionAuthProvider extends AuthProvider { - private readonly _horizonUrl: string; - private readonly _verifySsl: boolean; - private readonly _loginTimeout: number; - private _sessionCookie: string | undefined; - private _csrfTokenValue: string | undefined; - private _expired = true; - private _userDataDir: string | undefined; - - constructor( - horizonUrl: string, - verifySsl = true, - loginTimeout = DEFAULT_LOGIN_TIMEOUT_S, - ) { - super(); - this._horizonUrl = horizonUrl.replace(/\/+$/, ''); - this._verifySsl = verifySsl; - this._loginTimeout = loginTimeout; - } - - async getHeaders(): Promise> { - if (!this._sessionCookie) { - throw new Error( - 'No Play session available. Call refreshIfNeeded() first.', - ); - } - const cookieParts = [`PLAY_SESSION=${this._sessionCookie}`]; - if (this._csrfTokenValue) { - cookieParts.push(`csrf-token=${this._csrfTokenValue}`); - } - return { Cookie: cookieParts.join('; ') }; - } - - async refreshIfNeeded(): Promise { - if (this._expired || !this._sessionCookie) { - await this._acquireSession(); - } - } - - async markAuthFailed(): Promise { - logger.warning( - 'Session expired - reopening browser for re-authentication.', - ); - this._expired = true; - } - - async cleanup(): Promise { - // Remove any temp Chromium profile dir still tracked (e.g. when the - // process is interrupted mid-login and the in-flight cleanup never ran). - if (!this._userDataDir) { - return; - } - const { rmSync } = await import('node:fs'); - try { - rmSync(this._userDataDir, { recursive: true, force: true }); - } catch { - // Best-effort - the dir lives under os.tmpdir() and the OS will reap it. - } - this._userDataDir = undefined; - } - - get csrfToken(): string | undefined { - return this._csrfTokenValue; - } - - private async _acquireSession(): Promise { - await PlaySessionAuthProvider._checkPlaywrightAvailable(); - - // Dynamic import - playwright is optional - const { chromium } = await import('playwright'); - - logger.info( - `Opening browser for Horizon authentication at ${this._horizonUrl}...`, - ); - - const { mkdtempSync, rmSync } = await import('node:fs'); - const { tmpdir } = await import('node:os'); - const { join } = await import('node:path'); - const userDataDir = mkdtempSync(join(tmpdir(), 'horizon-mcp-')); - this._userDataDir = userDataDir; - - let context; - try { - context = await chromium.launchPersistentContext(userDataDir, { - headless: false, - ignoreHTTPSErrors: !this._verifySsl, - }); - } catch (err) { - rmSync(userDataDir, { recursive: true, force: true }); - this._userDataDir = undefined; - const msg = String(err).toLowerCase(); - if ( - msg.includes("executable doesn't exist") || - msg.includes('browsertype.launch') - ) { - throw new Error( - 'Chromium browser not found. Run: npx playwright install chromium', - ); - } - throw new Error(`Failed to launch browser: ${err}`); - } - - try { - await this._runAuthFlowWithRetry(context); - } finally { - await context.close(); - rmSync(userDataDir, { recursive: true, force: true }); - this._userDataDir = undefined; - } - - this._expired = false; - logger.info('Authentication successful - browser closed.'); - } - - private async _runAuthFlowWithRetry(context: unknown): Promise { - // Type the context at runtime since playwright is optional - const ctx = context as import('playwright').BrowserContext; - let lastError: OidcFlowError | undefined; - - for (let attempt = 1; attempt <= MAX_OIDC_RETRIES; attempt++) { - const page = - ctx.pages().length > 0 ? ctx.pages()[0]! : await ctx.newPage(); - - try { - await page.goto(this._horizonUrl); - } catch (err) { - throw new Error( - `Failed to navigate to ${this._horizonUrl}. ` + - `Check HORIZON_URL and network connectivity. (${err})`, - ); - } - - const initialSession = await this._getCookieValue(ctx, 'PLAY_SESSION'); - if (initialSession) { - logger.info( - 'Pre-auth PLAY_SESSION detected - waiting for ' + - 'authenticated session (cookie value change).', - ); - } - - try { - const sessionCookie = await this._waitForAuthenticatedSession( - ctx, - page, - initialSession, - this._loginTimeout, - ); - this._sessionCookie = sessionCookie; - this._csrfTokenValue = await this._getCookieValue(ctx, 'csrf-token'); - return; - } catch (err) { - if (err instanceof OidcFlowError) { - lastError = err; - if (attempt < MAX_OIDC_RETRIES) { - logger.warning( - `OIDC code verifier expired (attempt ${attempt}/${MAX_OIDC_RETRIES}). ` + - 'Retrying - IdP SSO cookies should make this instant...', - ); - continue; - } - } else { - throw err; - } - } - } - - throw new Error( - `OIDC authentication failed after ${MAX_OIDC_RETRIES} attempts. ` + - `Last error: ${lastError}`, - ); - } - - private static async _checkPlaywrightAvailable(): Promise { - try { - await import('playwright'); - } catch { - throw new Error( - 'Play session auth requires Playwright. ' + - 'Install: npm install playwright && npx playwright install chromium', - ); - } - } - - private async _getCookieValue( - context: import('playwright').BrowserContext, - name: string, - ): Promise { - const cookies = await context.cookies(this._horizonUrl); - const cookie = cookies.find((c) => c.name === name); - return cookie?.value; - } - - private async _waitForAuthenticatedSession( - context: import('playwright').BrowserContext, - page: import('playwright').Page, - initialValue: string | undefined, - timeoutS: number, - ): Promise { - const deadline = Date.now() + timeoutS * 1000; - - while (Date.now() < deadline) { - const current = await this._getCookieValue(context, 'PLAY_SESSION'); - if (current !== undefined && current !== initialValue) { - return current; - } - - PlaySessionAuthProvider._checkForOidcError(page); - - await new Promise((resolve) => setTimeout(resolve, 500)); - } - - throw new Error( - `Login timed out after ${timeoutS}s. ` + - 'Complete login in the browser window within the timeout.', - ); - } - - private static _checkForOidcError(page: import('playwright').Page): void { - const urlDecoded = decodeURIComponent(page.url()).toLowerCase(); - if ( - urlDecoded.includes('auth_error') && - urlDecoded.includes('code verifier') - ) { - throw new OidcFlowError( - 'OIDC PKCE code verifier expired server-side. ' + - "Manual IdP login took longer than the server's " + - 'code verifier TTL.', - ); - } - } -} diff --git a/src/client/http.ts b/src/client/http.ts index 8a73b61..198ee1d 100644 --- a/src/client/http.ts +++ b/src/client/http.ts @@ -403,20 +403,44 @@ export class HorizonClient { } private async _doLazyInit(): Promise { - // 1. Trigger auth (browser login for Play Session, no-op for others) + await this._performInit(false); + this._initialized = true; + } + + /** + * Strict, eager variant of lazy init for the HTTP per-session flow. Runs the + * exact same path as lazy init (refresh -> CSRF -> whoami -> capture + * principal/version -> version-compat log) but THROWS on any failure instead + * of logging-and-continuing, and marks the client initialized so the first + * tool call does not re-run init (and mutating calls still carry the captured + * CSRF token). The thrown error never echoes the caller's credential. + */ + async validateAuth(): Promise { + await this._performInit(true); + this._initialized = true; + } + + /** + * Shared init body for lazy (`strict=false`, log-and-continue) and eager + * `validateAuth` (`strict=true`, throw). Factored into one method so the two + * paths cannot drift. + */ + private async _performInit(strict: boolean): Promise { + // 1. Trigger auth (no-op for API key / mTLS / cert-forward). await this._auth.refreshIfNeeded(); - // 2. Fetch CSRF token + // 2. Fetch CSRF token. await this.fetchCsrfToken(); - // 3. Whoami - capture principal name + Horizon version - try { - const headers = await this._auth.getHeaders(); - if (this._csrfToken) { - headers['Csrf-Token'] = this._csrfToken; - } + // 3. Whoami - capture principal name + Horizon version. + const headers = await this._auth.getHeaders(); + if (this._csrfToken) { + headers['Csrf-Token'] = this._csrfToken; + } - const resp = await undiciFetch( + let resp: Response; + try { + resp = await undiciFetch( `${this._baseUrl}/api/v1/security/principals/self`, { method: 'GET', @@ -425,41 +449,47 @@ export class HorizonClient { signal: AbortSignal.timeout(this._timeout), }, ); - - if (resp.status === 200) { - const principal = (await resp.json()) as Record; - const identity = (principal['identity'] ?? {}) as Record< - string, - unknown - >; - this.principalName = - (identity['identifier'] as string | undefined) ?? - (principal['identifier'] as string | undefined) ?? - (principal['name'] as string | undefined) ?? - 'unknown'; - - this.horizonVersion = principal['_horizonVersion'] as - | string - | undefined; - - logger.info( - `Authenticated as: ${this.principalName} (Horizon ${this.horizonVersion ?? 'unknown'})`, - ); - - // 4. Log version compatibility - if (this.horizonVersion) { - this._logVersionCompatibility(this.horizonVersion); - } - } else { - logger.warning( - `Whoami returned ${resp.status} - continuing without principal info`, - ); - } } catch (err) { + if (strict) { + throw new HorizonError(0, { + message: `Authentication check could not reach Horizon: ${err}`, + remediation: 'Check HORIZON_URL and network connectivity.', + }); + } logger.warning(`Whoami failed: ${err} - continuing`); + return; } - this._initialized = true; + if (resp.status !== 200) { + if (strict) { + // parseErrorResponse redacts secrets; the whoami body never contains + // the caller's credential. + const text = await resp.text().catch(() => ''); + throw parseErrorResponse(resp.status, text); + } + logger.warning( + `Whoami returned ${resp.status} - continuing without principal info`, + ); + return; + } + + const principal = (await resp.json()) as Record; + const identity = (principal['identity'] ?? {}) as Record; + this.principalName = + (identity['identifier'] as string | undefined) ?? + (principal['identifier'] as string | undefined) ?? + (principal['name'] as string | undefined) ?? + 'unknown'; + this.horizonVersion = principal['_horizonVersion'] as string | undefined; + + logger.info( + `Authenticated as: ${this.principalName} (Horizon ${this.horizonVersion ?? 'unknown'})`, + ); + + // 4. Log version compatibility. + if (this.horizonVersion) { + this._logVersionCompatibility(this.horizonVersion); + } } private _logVersionCompatibility(version: string): void { diff --git a/src/http/config.ts b/src/http/config.ts new file mode 100644 index 0000000..95c2889 --- /dev/null +++ b/src/http/config.ts @@ -0,0 +1,295 @@ +import type { HorizonSettings } from '../settings.js'; + +/** + * Resolved, fail-closed HTTP configuration. Built once at startup (HTTP mode + * only) by `buildHttpConfig`, which performs every cross-field check the flat + * settings schema cannot express. Anything malformed throws here so the server + * refuses to start rather than guessing. + */ +export interface HttpMtlsConfig { + /** MCP terminates client TLS itself with its own listener cert/key. */ + readonly listener?: { readonly certPath: string; readonly keyPath: string }; + /** A trusted ingress terminates client TLS and forwards the cert header. */ + readonly inbound?: { readonly header: string; readonly trustedProxy: string }; + /** Horizon-facing header the MCP sets with the captured client cert. */ + readonly forwardHeader: string; +} + +export interface HttpConfig { + readonly host: string; + readonly port: number; + readonly path: string; + readonly publicEndpoint: string; + readonly allowedHosts: ReadonlySet; + readonly allowedOrigins: ReadonlySet; + readonly authMode: 'service' | 'api-key' | 'mtls'; + readonly mtls?: HttpMtlsConfig; +} + +// RFC 7230 token: the legal characters for an HTTP header field name. +const HTTP_TOKEN_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/; + +// Header names a configurable cert/inbound header must never shadow - either +// protocol-critical or already meaningful to Horizon / the MCP. Lowercased. +const FORBIDDEN_HEADERS: ReadonlySet = new Set([ + 'host', + 'connection', + 'content-length', + 'transfer-encoding', + 'cookie', + 'authorization', + 'x-api-id', + 'x-api-key', + 'csrf-token', +]); + +function fail(msg: string): never { + throw new Error(`Invalid HTTP configuration: ${msg}`); +} + +function isLoopbackHost(host: string): boolean { + const h = host.toLowerCase(); + return h === 'localhost' || h === '::1' || h.startsWith('127.'); +} + +function isIpv4Octets(value: string): boolean { + const parts = value.split('.'); + if (parts.length !== 4) return false; + return parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255); +} + +function validateTrustedProxy(value: string): string { + // A bare IPv6 literal is accepted as an exact-match peer. + if (value.includes(':') && !value.includes('/')) return value; + if (value.includes('/')) { + const [range, bitsStr] = value.split('/'); + const bits = Number(bitsStr); + if ( + !isIpv4Octets(range ?? '') || + !Number.isInteger(bits) || + bits < 0 || + bits > 32 + ) { + fail(`HORIZON_TRUSTED_PROXY "${value}" is not a valid IPv4 CIDR`); + } + return value; + } + if (!isIpv4Octets(value)) { + fail(`HORIZON_TRUSTED_PROXY "${value}" is not a valid IP or CIDR`); + } + return value; +} + +function validatePublicUrl(value: string): URL { + let url: URL; + try { + url = new URL(value); + } catch { + fail(`HORIZON_PUBLIC_URL "${value}" is not a valid URL`); + } + if (url.protocol !== 'http:' && url.protocol !== 'https:') { + fail(`HORIZON_PUBLIC_URL "${value}" must use http or https`); + } + if (!url.host) { + fail(`HORIZON_PUBLIC_URL "${value}" must include a host`); + } + return url; +} + +function validateHeaderName(value: string, envName: string): string { + if (!HTTP_TOKEN_RE.test(value)) { + fail(`${envName} "${value}" is not a valid HTTP header token`); + } + const lower = value.toLowerCase(); + if (FORBIDDEN_HEADERS.has(lower) || lower.startsWith('mcp-')) { + fail(`${envName} "${value}" collides with a reserved header name`); + } + return value; +} + +function normalizePath(path: string): string { + if (!path.startsWith('/')) { + fail(`HORIZON_HTTP_PATH "${path}" must be an absolute path (start with /)`); + } + if (path.includes('?') || path.includes('#')) { + fail(`HORIZON_HTTP_PATH "${path}" must not contain a query or fragment`); + } + // A trailing slash is normalized away (matched exactly, not a sub-route), + // except for the bare root path "/". + return path.length > 1 ? path.replace(/\/+$/, '') : path; +} + +function deriveAllowedHosts( + settings: HorizonSettings, + publicUrl: URL | undefined, +): ReadonlySet { + // Explicit trusted hosts always win. + if (settings.trustedHosts.length > 0) { + return new Set(settings.trustedHosts.map((h) => h.toLowerCase())); + } + // Otherwise derive the allowed Host from the public origin. + if (publicUrl) { + return new Set([publicUrl.host.toLowerCase()]); + } + // No public URL and no trusted hosts: only safe when bound to loopback. + if (!isLoopbackHost(settings.httpHost)) { + fail( + `bound to non-loopback host "${settings.httpHost}" but neither ` + + `HORIZON_PUBLIC_URL nor HORIZON_TRUSTED_HOSTS is set; refusing to ` + + `start (it would otherwise trust all Host values)`, + ); + } + const port = settings.httpPort; + return new Set([`localhost:${port}`, `127.0.0.1:${port}`, `[::1]:${port}`]); +} + +function derivePublicEndpoint( + settings: HorizonSettings, + path: string, + publicUrl: URL | undefined, +): string { + if (publicUrl) { + return new URL(path, publicUrl).toString(); + } + const host = settings.httpHost; + const hostPart = + host.includes(':') && !host.startsWith('[') ? `[${host}]` : host; + return `http://${hostPart}:${settings.httpPort}${path}`; +} + +function deriveAllowedOrigins(settings: HorizonSettings): ReadonlySet { + const out = new Set(); + for (const origin of settings.trustedOrigins) { + let url: URL; + try { + url = new URL(origin); + } catch { + fail(`HORIZON_TRUSTED_ORIGINS entry "${origin}" is not a valid origin`); + } + if (url.protocol !== 'http:' && url.protocol !== 'https:') { + fail(`HORIZON_TRUSTED_ORIGINS entry "${origin}" must use http or https`); + } + if (!url.host || url.origin.toLowerCase() === 'null') { + fail(`HORIZON_TRUSTED_ORIGINS entry "${origin}" has no usable origin`); + } + out.add(url.origin.toLowerCase()); + } + return out; +} + +function resolveMtls(settings: HorizonSettings): HttpMtlsConfig { + const hasCert = Boolean(settings.httpTlsCert); + const hasKey = Boolean(settings.httpTlsKey); + if ((hasCert || hasKey) && !(hasCert && hasKey)) { + fail( + `the mtls TLS listener needs both HORIZON_HTTP_TLS_CERT and ` + + `HORIZON_HTTP_TLS_KEY`, + ); + } + const haveListener = hasCert && hasKey; + const haveInbound = Boolean(settings.inboundCertHeader); + if (haveInbound && !settings.trustedProxy) { + fail(`HORIZON_INBOUND_CERT_HEADER requires HORIZON_TRUSTED_PROXY`); + } + if (!haveListener && !haveInbound) { + fail( + `mtls auth mode requires either a TLS listener (HORIZON_HTTP_TLS_CERT + ` + + `HORIZON_HTTP_TLS_KEY) or a trusted ingress (HORIZON_INBOUND_CERT_` + + `HEADER + HORIZON_TRUSTED_PROXY)`, + ); + } + if (haveListener && haveInbound) { + fail( + `configure either the TLS listener or the inbound cert header, not both`, + ); + } + + const forwardHeader = validateHeaderName( + settings.forwardCertHeader, + 'HORIZON_FORWARD_CERT_HEADER', + ); + return { + forwardHeader, + ...(haveListener + ? { + listener: { + certPath: settings.httpTlsCert, + keyPath: settings.httpTlsKey, + }, + } + : {}), + ...(haveInbound + ? { + inbound: { + header: validateHeaderName( + settings.inboundCertHeader, + 'HORIZON_INBOUND_CERT_HEADER', + ), + trustedProxy: validateTrustedProxy(settings.trustedProxy), + }, + } + : {}), + }; +} + +function resolveAuthMode( + settings: HorizonSettings, +): HttpMtlsConfig | undefined { + switch (settings.httpAuthMode) { + case 'service': { + const hasEnvCred = Boolean( + settings.clientCert || settings.clientPfx || settings.apiId, + ); + if (!hasEnvCred) { + fail( + `service auth mode requires an env credential ` + + `(HORIZON_API_ID/HORIZON_API_KEY or ` + + `HORIZON_CLIENT_CERT/KEY or HORIZON_CLIENT_PFX)`, + ); + } + return undefined; + } + case 'api-key': + return undefined; + case 'mtls': + return resolveMtls(settings); + } +} + +/** + * Validate and resolve every HTTP-mode setting into an HttpConfig, or throw. + * Call only when `settings.transport === 'http'`. `env` is consulted solely + * for the HORIZON_ALLOW_PRIVATE_TLS_PROBE fail-closed gate. + */ +export function buildHttpConfig( + settings: HorizonSettings, + env: Record = process.env, +): HttpConfig { + if (env['HORIZON_ALLOW_PRIVATE_TLS_PROBE'] === '1') { + fail( + `HORIZON_ALLOW_PRIVATE_TLS_PROBE=1 is not allowed in HTTP mode: it would ` + + `turn fetch_exposed_certificate into an internal-network probe ` + + `reachable by any caller`, + ); + } + + const path = normalizePath(settings.httpPath); + const publicUrl = settings.publicUrl + ? validatePublicUrl(settings.publicUrl) + : undefined; + const allowedHosts = deriveAllowedHosts(settings, publicUrl); + const publicEndpoint = derivePublicEndpoint(settings, path, publicUrl); + const allowedOrigins = deriveAllowedOrigins(settings); + const mtls = resolveAuthMode(settings); + + return { + host: settings.httpHost, + port: settings.httpPort, + path, + publicEndpoint, + allowedHosts, + allowedOrigins, + authMode: settings.httpAuthMode, + ...(mtls ? { mtls } : {}), + }; +} diff --git a/src/http/credentials.ts b/src/http/credentials.ts new file mode 100644 index 0000000..d28440d --- /dev/null +++ b/src/http/credentials.ts @@ -0,0 +1,251 @@ +import { ApiKeyAuthProvider } from '../auth/apikey.js'; +import type { AuthProvider } from '../auth/base.js'; +import { CertForwardAuthProvider } from '../auth/cert-forward.js'; +import { createAuthProvider } from '../auth/index.js'; +import type { HorizonSettings } from '../settings.js'; +import type { HttpConfig } from './config.js'; +import { credentialFingerprint } from './fingerprint.js'; + +/** Raised when a request's credential is missing, wrong-type, or unexpected. */ +export class CredentialError extends Error { + readonly status: number; + constructor(status: number, message: string) { + super(message); + this.name = 'CredentialError'; + this.status = status; + } +} + +export type CredentialMaterial = + | { kind: 'service' } + | { kind: 'api-key'; apiId: string; apiKey: string } + | { kind: 'cert'; pem: string }; + +/** Minimal shape of the inbound request that credential resolution needs. */ +export interface CredentialRequest { + headers: Record; + socket: { + remoteAddress?: string; + getPeerCertificate?: (detailed?: boolean) => { raw?: Buffer } | undefined; + }; +} + +// Client-supplied credential headers that service mode must reject outright. +const CLIENT_CRED_HEADERS = [ + 'x-api-id', + 'x-api-key', + 'authorization', + 'proxy-authorization', + 'cookie', + 'ssl-client-cert', + 'ssl_client_cert', + 'x-forwarded-client-cert', + 'x-forwarded-tls-client-cert', +]; + +function headerValue( + headers: CredentialRequest['headers'], + name: string, +): string | undefined { + const v = headers[name.toLowerCase()] ?? headers[name]; + return Array.isArray(v) ? v[0] : v; +} + +function hasPeerCert(req: CredentialRequest): boolean { + const cert = req.socket.getPeerCertificate?.(); + return Boolean(cert && cert.raw && cert.raw.length > 0); +} + +// -- IP / proxy matching ------------------------------------------------------ + +function normalizeV4(addr: string): string { + // IPv4-mapped IPv6 (e.g. ::ffff:10.0.0.5) -> 10.0.0.5 + return addr.replace(/^::ffff:/i, ''); +} + +function ipv4ToInt(addr: string): number | undefined { + const parts = addr.split('.'); + if (parts.length !== 4) return undefined; + let acc = 0; + for (const part of parts) { + const n = Number(part); + if (!Number.isInteger(n) || n < 0 || n > 255) return undefined; + acc = (acc << 8) | n; + } + return acc >>> 0; +} + +/** + * Whether the direct TCP peer address matches a trusted-proxy spec (an exact + * IP or an IPv4 CIDR). The caller MUST pass `req.socket.remoteAddress`, never + * an X-Forwarded-For value. + */ +export function peerMatchesProxy( + remoteAddress: string | undefined, + spec: string, +): boolean { + if (!remoteAddress) return false; + const addr = normalizeV4(remoteAddress); + + if (spec.includes('/')) { + const [range, bitsStr] = spec.split('/'); + const bits = Number.parseInt(bitsStr ?? '', 10); + const a = ipv4ToInt(addr); + const r = ipv4ToInt(normalizeV4(range ?? '')); + if (a === undefined || r === undefined || !Number.isFinite(bits)) { + return addr === normalizeV4(range ?? ''); + } + if (bits === 0) return true; // /0 = all peers (validated at startup) + if (bits < 0 || bits > 32) return false; + const mask = (~0 << (32 - bits)) >>> 0; + return (a & mask) === (r & mask); + } + + return addr === normalizeV4(spec); +} + +// -- Certificate encoding ----------------------------------------------------- + +function derToPem(der: Buffer): string { + const b64 = der.toString('base64'); + const lines = b64.match(/.{1,64}/g) ?? [b64]; + return `-----BEGIN CERTIFICATE-----\n${lines.join('\n')}\n-----END CERTIFICATE-----\n`; +} + +/** + * Decode a forwarded client certificate header into a PEM string. Accepts + * URL-encoded PEM (nginx `$ssl_client_escaped_cert`), raw PEM, or base64 DER + * (HAProxy-style), normalizing all to PEM. + */ +export function decodeForwardedCert(value: string): string { + let decoded = value; + if (value.includes('%')) { + try { + decoded = decodeURIComponent(value); + } catch { + decoded = value; + } + } + if (decoded.includes('BEGIN CERTIFICATE')) { + return decoded; + } + const der = Buffer.from(decoded.replace(/\s+/g, ''), 'base64'); + return derToPem(der); +} + +// -- Resolution --------------------------------------------------------------- + +/** + * Resolve the credential material from a request per the fixed auth mode. + * Throws CredentialError on a missing, wrong-type, or unexpected credential. + */ +export function extractCredential( + req: CredentialRequest, + config: HttpConfig, +): CredentialMaterial { + switch (config.authMode) { + case 'service': { + for (const name of CLIENT_CRED_HEADERS) { + if (headerValue(req.headers, name) !== undefined) { + throw new CredentialError( + 400, + `unexpected client credential header "${name}" in service auth mode`, + ); + } + } + if (hasPeerCert(req)) { + throw new CredentialError( + 400, + 'unexpected client certificate in service auth mode', + ); + } + return { kind: 'service' }; + } + + case 'api-key': { + const apiId = headerValue(req.headers, 'x-api-id'); + const apiKey = headerValue(req.headers, 'x-api-key'); + if (!apiId || !apiKey) { + throw new CredentialError( + 401, + 'api-key auth mode requires both X-API-ID and X-API-KEY headers', + ); + } + return { kind: 'api-key', apiId, apiKey }; + } + + case 'mtls': { + const mtls = config.mtls; + if (!mtls) { + throw new CredentialError(500, 'mtls auth mode is misconfigured'); + } + if (mtls.inbound) { + if ( + !peerMatchesProxy(req.socket.remoteAddress, mtls.inbound.trustedProxy) + ) { + throw new CredentialError( + 401, + 'client certificate header presented from an untrusted peer', + ); + } + const raw = headerValue(req.headers, mtls.inbound.header); + if (!raw) { + throw new CredentialError(401, 'missing client certificate header'); + } + return { kind: 'cert', pem: decodeForwardedCert(raw) }; + } + const cert = req.socket.getPeerCertificate?.(); + if (!cert || !cert.raw || cert.raw.length === 0) { + throw new CredentialError(401, 'no client certificate was presented'); + } + return { kind: 'cert', pem: derToPem(cert.raw) }; + } + } +} + +/** + * The fingerprint a credential material binds to, or undefined for service mode + * (no per-caller binding). Used both at session creation and on each later + * request to re-verify the resent credential matches its session. + */ +export function credentialFingerprintOf( + material: CredentialMaterial, +): string | undefined { + switch (material.kind) { + case 'service': + return undefined; + case 'api-key': + return credentialFingerprint(`${material.apiId}:${material.apiKey}`); + case 'cert': + return credentialFingerprint(material.pem); + } +} + +/** + * Build the per-session AuthProvider and (for per-caller modes) the credential + * fingerprint used to anti-hijack-bind the session. Service mode forwards the + * env identity and binds no fingerprint (Mcp-Session-Id behaves as a bearer). + */ +export function buildSessionAuth( + material: CredentialMaterial, + config: HttpConfig, + settings: HorizonSettings, +): { auth: AuthProvider; fingerprint?: string } { + const fingerprint = credentialFingerprintOf(material); + switch (material.kind) { + case 'service': + return { auth: createAuthProvider(settings) }; + case 'api-key': + return { + auth: new ApiKeyAuthProvider(material.apiId, material.apiKey), + fingerprint, + }; + case 'cert': { + const forwardHeader = config.mtls?.forwardHeader ?? 'SSL_CLIENT_CERT'; + return { + auth: new CertForwardAuthProvider(forwardHeader, material.pem), + fingerprint, + }; + } + } +} diff --git a/src/http/fingerprint.ts b/src/http/fingerprint.ts new file mode 100644 index 0000000..dfb8202 --- /dev/null +++ b/src/http/fingerprint.ts @@ -0,0 +1,35 @@ +import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'; + +// Per-process random HMAC key. Fingerprints are only ever compared within the +// lifetime of one process (to bind a session to its credential), so a fresh +// random key per process is exactly right: it makes the fingerprint useless to +// anyone who later sees it, and ties it to nothing persistent. +const FINGERPRINT_KEY = randomBytes(32); + +const SHORT_LEN = 12; + +/** + * Keyed fingerprint of a credential's canonical bytes (HMAC-SHA-256). The + * caller supplies the canonical form: `apiId + ':' + apiKey` for API keys, the + * certificate's canonical PEM/DER for mTLS. Returns a 64-char hex digest. The + * raw credential is never recoverable from the fingerprint. + */ +export function credentialFingerprint(canonical: string): string { + return createHmac('sha256', FINGERPRINT_KEY).update(canonical).digest('hex'); +} + +/** + * Timing-safe comparison of two hex fingerprints. Returns false (never throws) + * when the lengths differ, so it is safe to call on attacker-controlled input. + */ +export function fingerprintsMatch(a: string, b: string): boolean { + const ba = Buffer.from(a, 'hex'); + const bb = Buffer.from(b, 'hex'); + if (ba.length !== bb.length || ba.length === 0) return false; + return timingSafeEqual(ba, bb); +} + +/** A truncated fingerprint prefix, safe to put in logs. */ +export function shortFingerprint(fingerprint: string): string { + return fingerprint.slice(0, SHORT_LEN); +} diff --git a/src/http/headers.ts b/src/http/headers.ts new file mode 100644 index 0000000..02ed4fd --- /dev/null +++ b/src/http/headers.ts @@ -0,0 +1,76 @@ +/** + * Central credential-header hygiene for HTTP mode. + * + * Two concerns: + * - Stripping: after the session credential is captured and fingerprinted at + * initialize, the secret headers must be removed before the request reaches + * `transport.handleRequest`, so they never surface in `requestInfo.headers` + * inside tool handlers. The SDK converts the Node request via + * `@hono/node-server`, which builds the Web request headers from + * `req.rawHeaders` (the raw array), NOT the parsed `req.headers` object - so + * BOTH must be scrubbed. + * - Redaction: access logs and error paths never print these names' values; + * callers log only method/path/status and a session fingerprint. + */ + +// Lowercased header names that must never be logged or forwarded onward. +export const DEFAULT_SENSITIVE_HEADERS: ReadonlySet = new Set([ + 'x-api-id', + 'x-api-key', + 'authorization', + 'proxy-authorization', + 'cookie', + 'set-cookie', + 'csrf-token', + // Common client-cert forwarding header aliases. + 'ssl-client-cert', + 'ssl_client_cert', + 'x-forwarded-client-cert', + 'x-forwarded-tls-client-cert', +]); + +/** + * The default sensitive set plus any deployment-specific header names (e.g. the + * configured inbound and forward cert headers), lowercased. + */ +export function buildSensitiveHeaderSet(extra: Iterable): Set { + const set = new Set(DEFAULT_SENSITIVE_HEADERS); + for (const name of extra) { + if (name) set.add(name.toLowerCase()); + } + return set; +} + +interface ScrubbableRequest { + headers: Record; + rawHeaders: string[]; +} + +/** + * Remove every sensitive header from BOTH the parsed `headers` object and the + * `rawHeaders` array, in place. Call after capturing/fingerprinting the + * credential and BEFORE `transport.handleRequest`. + */ +export function scrubSensitiveHeaders( + req: ScrubbableRequest, + sensitive: ReadonlySet, +): void { + // 1. Parsed headers (Node lowercases these keys, but be defensive). + for (const name of Object.keys(req.headers)) { + if (sensitive.has(name.toLowerCase())) { + delete req.headers[name]; + } + } + + // 2. Raw headers: [name0, value0, name1, value1, ...]. Drop name/value pairs + // whose name (even index) is sensitive. + const raw = req.rawHeaders; + const cleaned: string[] = []; + for (let i = 0; i + 1 < raw.length; i += 2) { + const name = raw[i]!; + if (!sensitive.has(name.toLowerCase())) { + cleaned.push(name, raw[i + 1]!); + } + } + req.rawHeaders = cleaned; +} diff --git a/src/http/jsonrpc.ts b/src/http/jsonrpc.ts new file mode 100644 index 0000000..86c0b3b --- /dev/null +++ b/src/http/jsonrpc.ts @@ -0,0 +1,59 @@ +export type JsonRpcId = string | number | null; + +interface JsonRpcMessage { + method?: unknown; + id?: unknown; +} + +/** Normalize a parsed JSON-RPC body (object, batch array, or empty) to a list. */ +export function messagesOf(body: unknown): JsonRpcMessage[] { + if (Array.isArray(body)) return body as JsonRpcMessage[]; + if (body === null || body === undefined) return []; + return [body as JsonRpcMessage]; +} + +/** The method names present in the body (skips entries without a method). */ +export function methodsOf(body: unknown): string[] { + return messagesOf(body) + .map((m) => (typeof m?.method === 'string' ? m.method : '')) + .filter((m) => m.length > 0); +} + +/** The id of the first message, or null. */ +export function firstId(body: unknown): JsonRpcId { + const msg = messagesOf(body)[0]; + if (msg && (typeof msg.id === 'string' || typeof msg.id === 'number')) { + return msg.id; + } + return null; +} + +/** + * A no-session POST must carry exactly one `initialize` message. Reject empty + * bodies, batches, and any non-initialize first message. + */ +export function validateInitialize( + body: unknown, +): { ok: true } | { ok: false; reason: string } { + const msgs = messagesOf(body); + if (msgs.length === 0) return { ok: false, reason: 'empty request body' }; + if (msgs.length > 1) { + return { ok: false, reason: 'a batch cannot open a session' }; + } + if (msgs[0]?.method !== 'initialize') { + return { ok: false, reason: 'first message must be initialize' }; + } + return { ok: true }; +} + +export function jsonRpcErrorBody( + id: JsonRpcId | undefined, + code: number, + message: string, +): { jsonrpc: '2.0'; id: JsonRpcId; error: { code: number; message: string } } { + return { + jsonrpc: '2.0', + id: id ?? null, + error: { code, message }, + }; +} diff --git a/src/http/middleware.ts b/src/http/middleware.ts new file mode 100644 index 0000000..1072ca4 --- /dev/null +++ b/src/http/middleware.ts @@ -0,0 +1,63 @@ +import type { HttpConfig } from './config.js'; + +/** + * Host-header validation (DNS-rebinding defense). The Host must exactly match + * one of the allowed values (case-insensitive, trailing dot tolerated). A + * missing Host is rejected - every HTTP/1.1 request carries one. + */ +export function isHostAllowed( + hostHeader: string | undefined, + allowed: ReadonlySet, +): boolean { + if (!hostHeader) return false; + const host = hostHeader.toLowerCase().replace(/\.$/, ''); + return allowed.has(host); +} + +/** + * Origin validation. A request with no Origin is allowed (non-browser MCP + * clients send none). A present Origin must be in the allow-list; when no + * origins are configured, any present Origin is rejected. + */ +export function isOriginAllowed( + originHeader: string | undefined, + allowed: ReadonlySet, +): boolean { + if (originHeader === undefined) return true; + return allowed.has(originHeader.toLowerCase()); +} + +/** Request headers the browser CORS preflight is allowed to send. */ +export function allowedRequestHeaders(config: HttpConfig): string[] { + const base = [ + 'Content-Type', + 'Accept', + 'Mcp-Session-Id', + 'Mcp-Protocol-Version', + 'Last-Event-ID', + ]; + if (config.authMode === 'api-key') { + base.push('X-API-ID', 'X-API-KEY'); + } + return base; +} + +/** + * CORS response headers for an allowed Origin. No wildcard-with-credentials: + * the server never relies on cookies, so credentials are not enabled, and the + * echoed Origin is only ever one already validated by `isOriginAllowed`. + */ +export function corsHeaders( + origin: string | undefined, + config: HttpConfig, +): Record { + const headers: Record = { Vary: 'Origin' }; + if (origin !== undefined && config.allowedOrigins.has(origin.toLowerCase())) { + headers['Access-Control-Allow-Origin'] = origin; + headers['Access-Control-Allow-Methods'] = 'GET, POST, DELETE, OPTIONS'; + headers['Access-Control-Allow-Headers'] = + allowedRequestHeaders(config).join(', '); + headers['Access-Control-Expose-Headers'] = 'Mcp-Session-Id'; + } + return headers; +} diff --git a/src/http/rate-limit.ts b/src/http/rate-limit.ts new file mode 100644 index 0000000..79eac20 --- /dev/null +++ b/src/http/rate-limit.ts @@ -0,0 +1,67 @@ +interface Window { + start: number; + count: number; +} + +/** + * Fixed-window rate limiter keyed by an arbitrary string (session id, remote + * address, or a constant for a global cap). A limit of 0 disables it entirely. + * The window is one second. + */ +export class RateLimiter { + private readonly windows = new Map(); + + constructor( + private readonly limit: number, + private readonly now: () => number = Date.now, + ) {} + + private windowFor(key: string, t: number): Window { + let w = this.windows.get(key); + if (!w || t - w.start >= 1000) { + w = { start: t, count: 0 }; + this.windows.set(key, w); + } + return w; + } + + /** Try to consume `cost` from one key's budget. */ + tryAcquire(key: string, cost = 1): boolean { + if (this.limit <= 0) return true; + const w = this.windowFor(key, this.now()); + if (w.count + cost > this.limit) return false; + w.count += cost; + return true; + } + + /** + * Atomic across multiple keys: consume `cost` from every key only if all have + * capacity, otherwise consume nothing and return false. Used for the init + * limit (a global cap AND a per-remote-address cap). + */ + tryAcquireAll(keys: readonly string[], cost = 1): boolean { + if (this.limit <= 0) return true; + const t = this.now(); + const targets = keys.map((k) => this.windowFor(k, t)); + if (targets.some((w) => w.count + cost > this.limit)) return false; + for (const w of targets) w.count += cost; + return true; + } + + /** Drop a key's window (e.g. on session teardown). */ + forget(key: string): void { + this.windows.delete(key); + } + + /** + * Delete windows whose period has fully elapsed. Bounds the key map for + * limiters keyed by unbounded values (e.g. the per-remote-address init + * limiter). Safe to call periodically. + */ + prune(): void { + const t = this.now(); + for (const [key, w] of this.windows) { + if (t - w.start >= 1000) this.windows.delete(key); + } + } +} diff --git a/src/http/server.ts b/src/http/server.ts new file mode 100644 index 0000000..d8c1e00 --- /dev/null +++ b/src/http/server.ts @@ -0,0 +1,569 @@ +import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; +import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'; +import express, { + type NextFunction, + type Request, + type Response, +} from 'express'; +import { randomUUID } from 'node:crypto'; +import { readFileSync } from 'node:fs'; +import { type Server, createServer as createHttpServer } from 'node:http'; +import { createServer as createHttpsServer } from 'node:https'; + +import type { AuthProvider } from '../auth/base.js'; +import { HorizonError } from '../client/errors.js'; +import { HorizonClient } from '../client/http.js'; +import { getLogger, runWithLoggingSink } from '../logging.js'; +import { createSessionServer } from '../server-factory.js'; +import type { HorizonSettings } from '../settings.js'; +import type { HttpConfig } from './config.js'; +import { + CredentialError, + buildSessionAuth, + credentialFingerprintOf, + extractCredential, +} from './credentials.js'; +import { + credentialFingerprint, + fingerprintsMatch, + shortFingerprint, +} from './fingerprint.js'; +import { buildSensitiveHeaderSet, scrubSensitiveHeaders } from './headers.js'; +import { + type JsonRpcId, + firstId, + jsonRpcErrorBody, + messagesOf, + methodsOf, + validateInitialize, +} from './jsonrpc.js'; +import { corsHeaders, isHostAllowed, isOriginAllowed } from './middleware.js'; +import { RateLimiter } from './rate-limit.js'; +import { SessionManager } from './session-manager.js'; + +const logger = getLogger('horizon_mcp.http'); + +export interface HttpServerHandle { + port: number; + url: string; + sessions: SessionManager; + close(): Promise; +} + +type TransportLike = { + handleRequest(req: unknown, res: unknown, body?: unknown): Promise; +}; + +type McpSink = ( + level: string, + payload: { logger: string; msg: string; extra?: Record }, +) => void; + +function headerStr(value: string | string[] | undefined): string | undefined { + return Array.isArray(value) ? value[0] : value; +} + +function once(fn: () => void): () => void { + let done = false; + return () => { + if (!done) { + done = true; + fn(); + } + }; +} + +/** Start the streamable-HTTP MCP server. Returns a handle that closes it. */ +export async function startHttpServer( + settings: HorizonSettings, + config: HttpConfig, +): Promise { + const clientOptions = { + timeout: settings.timeout, + exportTimeout: settings.exportTimeout, + verifySsl: settings.verifySsl, + testedVersions: settings.testedVersions, + warnVersions: settings.warnVersions, + }; + + const sensitive = buildSensitiveHeaderSet([ + config.mtls?.forwardHeader ?? '', + config.mtls?.inbound?.header ?? '', + ]); + + const initLimiter = new RateLimiter(settings.initRateLimit); + const sessionLimiter = new RateLimiter(settings.rateLimitRps); + const sinks = new Map(); + + const manager = new SessionManager({ + maxSessions: settings.maxSessions, + idleTtlMs: settings.sessionIdleTtl * 1000, + absTtlMs: settings.sessionAbsTtl * 1000, + maxInflight: settings.maxInflightToolcalls, + onTeardown: (sessionId) => { + sessionLimiter.forget(sessionId); + sinks.delete(sessionId); + }, + }); + + function makeSink(server: McpServer): McpSink { + return (level, payload) => { + void Promise.resolve() + .then(() => + server.server.sendLoggingMessage({ + level: level as + | 'debug' + | 'info' + | 'notice' + | 'warning' + | 'error' + | 'critical' + | 'alert' + | 'emergency', + logger: payload.logger, + data: { msg: payload.msg, ...(payload.extra ?? {}) }, + }), + ) + .catch(() => { + // transport closing / client opted out - keep the log local only + }); + }; + } + + function sendError( + res: Response, + status: number, + id: JsonRpcId | undefined, + message: string, + ): void { + if (!res.headersSent) { + res.status(status).json(jsonRpcErrorBody(id, -32600, message)); + } + } + + function handleCredentialError( + res: Response, + err: unknown, + id: JsonRpcId | undefined, + ): void { + if (err instanceof CredentialError) { + sendError(res, err.status, id, err.message); + return; + } + throw err; + } + + // Verify the resent credential still matches the session (anti-hijack). + // Returns true to continue, false after sending an error response. + function ensureFingerprintBinding( + req: Request, + res: Response, + fingerprint: string | undefined, + ): boolean { + if (!fingerprint) return true; // service mode: no per-caller binding + let material; + try { + material = extractCredential(req, config); + } catch (err) { + handleCredentialError(res, err, null); + return false; + } + const fp = credentialFingerprintOf(material); + if (!fp || !fingerprintsMatch(fp, fingerprint)) { + sendError(res, 401, null, 'session credential does not match'); + return false; + } + return true; + } + + async function dispatch( + transport: TransportLike, + sink: McpSink, + req: Request, + res: Response, + body?: unknown, + ): Promise { + // Scrub the captured secret headers from BOTH req.headers and + // req.rawHeaders before the SDK (via @hono/node-server) reads them. + scrubSensitiveHeaders(req, sensitive); + await runWithLoggingSink(sink, () => + transport.handleRequest(req, res, body), + ); + } + + async function handleInitialize(req: Request, res: Response): Promise { + const body: unknown = req.body; + const valid = validateInitialize(body); + if (!valid.ok) { + sendError(res, 400, firstId(body), valid.reason); + return; + } + + const peer = req.socket.remoteAddress ?? 'unknown'; + if (!initLimiter.tryAcquireAll(['__global__', peer])) { + sendError(res, 429, firstId(body), 'too many initialization attempts'); + return; + } + // Reserve capacity atomically: the session is only registered later, inside + // onsessioninitialized, after the validateAuth + connect awaits below, so a + // plain canCreate() check would let concurrent initializes overshoot. + if (!manager.tryReserve()) { + sendError(res, 503, firstId(body), 'maximum sessions reached'); + return; + } + + // Own every resource until the session is registered. If the SDK rejects the + // initialize (e.g. a credentialed body that fails JSONRPCMessageSchema), + // onsessioninitialized never fires and the session is never tracked, so the + // finally below must release the reservation and close the orphans. + let registered = false; + let client: HorizonClient | undefined; + let auth: AuthProvider | undefined; + let mcp: McpServer | undefined; + try { + let material; + try { + material = extractCredential(req, config); + } catch (err) { + handleCredentialError(res, err, firstId(body)); + return; + } + + const built = buildSessionAuth(material, config, settings); + auth = built.auth; + const fingerprint = built.fingerprint; + client = new HorizonClient(settings.url, auth, clientOptions); + try { + await client.validateAuth(); + } catch (err) { + const status = + err instanceof HorizonError && err.statusCode >= 400 + ? err.statusCode + : 502; + sendError( + res, + status, + firstId(body), + status === 502 ? 'horizon unreachable' : 'authentication failed', + ); + return; + } + + mcp = createSessionServer(client); + // const aliases so the closure sees definitely-assigned values. + const sessionClient = client; + const sessionAuth = auth; + const sessionMcp = mcp; + const transport = new StreamableHTTPServerTransport({ + sessionIdGenerator: () => randomUUID(), + onsessioninitialized: (sessionId) => { + manager.create({ + sessionId, + server: sessionMcp, + transport, + client: sessionClient, + auth: sessionAuth, + credentialFingerprint: fingerprint, + }); + sinks.set(sessionId, makeSink(sessionMcp)); + registered = true; + logger.info('session initialized', { + session: shortFingerprint(credentialFingerprint(sessionId)), + }); + }, + onsessionclosed: (sessionId) => { + void manager.handleSessionClosed(sessionId); + }, + }); + mcp.server.oninitialized = () => { + const sid = transport.sessionId; + if (sid) manager.markReady(sid); + }; + await mcp.connect(transport); + + await dispatch( + transport as unknown as TransportLike, + makeSink(mcp), + req, + res, + body, + ); + } finally { + if (!registered) { + manager.releaseReservation(); + // server.close() cascades to the transport in SDK 1.29.0. + if (mcp) await mcp.close().catch(() => undefined); + if (client) await client.close().catch(() => undefined); + if (auth) await auth.cleanup().catch(() => undefined); + } + } + } + + async function handleExistingPost( + req: Request, + res: Response, + sessionId: string, + ): Promise { + const record = manager.get(sessionId); + if (!record) { + sendError(res, 404, null, 'session not found'); + return; + } + if (!ensureFingerprintBinding(req, res, record.credentialFingerprint)) + return; + + const body: unknown = req.body; + const methods = methodsOf(body); + + if (record.state === 'initializing') { + const handshakeOnly = methods.every( + (m) => m === 'initialize' || m === 'notifications/initialized', + ); + if (!handshakeOnly) { + sendError(res, 409, firstId(body), 'session is not ready'); + return; + } + } + + // Rate limit is charged per JSON-RPC message (a batch of N costs N), + // including method-less messages such as responses/notifications. + const messageCount = messagesOf(body).length; + if ( + messageCount > 0 && + !sessionLimiter.tryAcquire(sessionId, messageCount) + ) { + sendError(res, 429, firstId(body), 'rate limit exceeded'); + return; + } + + const isWork = methods.some( + (m) => m !== 'initialize' && m !== 'notifications/initialized', + ); + if (isWork) { + if (!manager.reserveInflight(sessionId)) { + sendError(res, 429, firstId(body), 'too many in-flight tool calls'); + return; + } + const release = once(() => manager.releaseInflight(sessionId)); + res.on('close', release); + res.on('finish', release); + } + + const sink = + sinks.get(sessionId) ?? makeSink(record.server as unknown as McpServer); + await dispatch( + record.transport as unknown as TransportLike, + sink, + req, + res, + body, + ); + } + + async function handleSessionStream( + req: Request, + res: Response, + ): Promise { + const sessionId = headerStr(req.headers['mcp-session-id']); + if (!sessionId) { + sendError(res, 400, null, 'missing Mcp-Session-Id'); + return; + } + const record = manager.get(sessionId); + if (!record) { + sendError(res, 404, null, 'session not found'); + return; + } + if (!ensureFingerprintBinding(req, res, record.credentialFingerprint)) + return; + + if (req.method === 'GET') { + res.setTimeout(settings.sseMaxDuration * 1000); + } + const sink = + sinks.get(sessionId) ?? makeSink(record.server as unknown as McpServer); + await dispatch( + record.transport as unknown as TransportLike, + sink, + req, + res, + ); + } + + // -- Express app ---------------------------------------------------------- + + const app = express(); + app.disable('x-powered-by'); + + function hostOk(req: Request): boolean { + return isHostAllowed(headerStr(req.headers.host), config.allowedHosts); + } + + // Health endpoints: unauthenticated, exempt from session/rate machinery, + // still Host-validated. + app.get('/healthz', (req, res) => { + if (!hostOk(req)) { + res.status(421).json({ status: 'misdirected' }); + return; + } + res.status(200).json({ status: 'ok' }); + }); + + app.get('/readyz', async (req, res) => { + if (!hostOk(req)) { + res.status(421).json({ status: 'misdirected' }); + return; + } + // Only service mode holds an env credential to probe Horizon with. + if (config.authMode === 'service') { + const { auth } = buildSessionAuth({ kind: 'service' }, config, settings); + const probe = new HorizonClient(settings.url, auth, clientOptions); + try { + await probe.validateAuth(); + } catch { + await probe.close().catch(() => undefined); + await auth.cleanup().catch(() => undefined); + res.status(503).json({ status: 'horizon-unreachable' }); + return; + } + await probe.close().catch(() => undefined); + await auth.cleanup().catch(() => undefined); + } + res.status(200).json({ status: 'ready' }); + }); + + const hostOriginGuard = (req: Request, res: Response, next: NextFunction) => { + if (!hostOk(req)) { + sendError(res, 421, null, 'host not allowed'); + return; + } + const origin = headerStr(req.headers.origin); + if (!isOriginAllowed(origin, config.allowedOrigins)) { + sendError(res, 403, null, 'origin not allowed'); + return; + } + for (const [k, v] of Object.entries(corsHeaders(origin, config))) { + res.setHeader(k, v); + } + if (req.method === 'OPTIONS') { + res.status(204).end(); + return; + } + next(); + }; + + const jsonParser = express.json({ limit: settings.maxBodyBytes }); + + app.all( + config.path, + hostOriginGuard, + jsonParser, + async (req: Request, res: Response) => { + try { + if (req.method === 'POST') { + const sessionId = headerStr(req.headers['mcp-session-id']); + if (sessionId) { + await handleExistingPost(req, res, sessionId); + } else { + await handleInitialize(req, res); + } + return; + } + if (req.method === 'GET' || req.method === 'DELETE') { + await handleSessionStream(req, res); + return; + } + sendError(res, 405, null, 'method not allowed'); + } catch (err) { + logger.error(`Unhandled HTTP error: ${err}`); + if (!res.headersSent) { + res + .status(500) + .json(jsonRpcErrorBody(null, -32603, 'internal error')); + } + } + }, + ); + + // Body-parser / size errors land here. + app.use((err: unknown, _req: Request, res: Response, _next: NextFunction) => { + const tooLarge = + typeof err === 'object' && + err !== null && + 'type' in err && + (err as { type?: string }).type === 'entity.too.large'; + if (!res.headersSent) { + res + .status(tooLarge ? 413 : 400) + .json( + jsonRpcErrorBody( + null, + -32700, + tooLarge ? 'request too large' : 'parse error', + ), + ); + } + }); + + // -- Listener ------------------------------------------------------------- + + const httpServer: Server = config.mtls?.listener + ? createHttpsServer( + { + cert: readFileSync(config.mtls.listener.certPath), + key: readFileSync(config.mtls.listener.keyPath), + requestCert: true, + rejectUnauthorized: false, // optional_no_ca: prove possession, not chain + }, + app, + ) + : createHttpServer(app); + + await new Promise((resolve, reject) => { + httpServer.once('error', reject); + httpServer.listen(config.port, config.host, () => { + httpServer.removeListener('error', reject); + resolve(); + }); + }); + + const address = httpServer.address(); + const boundPort = + typeof address === 'object' && address ? address.port : config.port; + + const sweepIntervalMs = Math.min( + 60_000, + Math.max( + 1000, + Math.floor( + Math.min(settings.sessionIdleTtl, settings.sessionAbsTtl) * 500, + ), + ), + ); + const sweeper = setInterval(() => { + void manager.sweepExpired(); + // Bound the rate-limiter key maps (e.g. the per-remote-address init limiter). + initLimiter.prune(); + sessionLimiter.prune(); + }, sweepIntervalMs); + sweeper.unref?.(); + + logger.info( + `HTTP transport listening on ${config.host}:${boundPort}${config.path} ` + + `(auth mode: ${config.authMode}, public: ${config.publicEndpoint})`, + ); + + return { + port: boundPort, + url: config.publicEndpoint, + sessions: manager, + async close() { + clearInterval(sweeper); + const closed = new Promise((resolve) => + httpServer.close(() => resolve()), + ); + await manager.shutdownAll(); + await closed; + }, + }; +} diff --git a/src/http/session-manager.ts b/src/http/session-manager.ts new file mode 100644 index 0000000..22b762b --- /dev/null +++ b/src/http/session-manager.ts @@ -0,0 +1,208 @@ +export type SessionState = 'initializing' | 'ready' | 'closing'; + +/** Closable MCP + Horizon resources owned by one session. */ +export interface SessionResources { + server: { close(): Promise }; + transport: { close(): Promise }; + client: { close(): Promise }; + auth: { cleanup(): Promise }; +} + +export interface SessionRecord extends SessionResources { + sessionId: string; + credentialFingerprint?: string; + state: SessionState; + createdAt: number; + lastSeenAt: number; + closed: boolean; + inflight: number; +} + +export interface SessionManagerOptions { + maxSessions: number; + idleTtlMs: number; + absTtlMs: number; + maxInflight: number; + now?: () => number; + /** Called after a session is torn down (any path), for ancillary cleanup. */ + onTeardown?: (sessionId: string, reason: string) => void; +} + +/** + * Owns the live HTTP sessions: lifecycle state, idle/absolute TTLs, inflight + * accounting, and the teardown discipline. + * + * Teardown closes exactly ONE MCP primitive, never both, because in SDK 1.29.0 + * closing the server cascades to the transport and vice-versa: + * - DELETE: the SDK already ran onsessionclosed then transport.close(), so + * `handleSessionClosed` only drops the record + closes Horizon resources. + * - idle/absolute TTL (and shutdown): no SDK callback fires, so `teardown` + * calls `server.close()` (which cascades to the transport) then closes + * Horizon resources. + * A per-session `closed` flag makes any cascaded or stray second call a no-op. + */ +export class SessionManager { + private readonly sessions = new Map(); + // Capacity reserved by initializes that are validating but not yet registered. + private pending = 0; + + constructor(private readonly opts: SessionManagerOptions) {} + + private now(): number { + return (this.opts.now ?? Date.now)(); + } + + get size(): number { + return this.sessions.size; + } + + canCreate(): boolean { + return this.sessions.size + this.pending < this.opts.maxSessions; + } + + /** + * Atomically reserve admission capacity for an initializing session, counting + * both live and pending sessions so concurrent initializes cannot overshoot + * maxSessions. Returns false when at capacity. Pair every true result with + * exactly one create() (which converts the reservation) or + * releaseReservation() (which drops it). + */ + tryReserve(): boolean { + if (this.sessions.size + this.pending >= this.opts.maxSessions) { + return false; + } + this.pending += 1; + return true; + } + + /** Drop a reservation that never became a session. */ + releaseReservation(): void { + this.pending = Math.max(0, this.pending - 1); + } + + /** Register a freshly initialized session. */ + create(input: { + sessionId: string; + credentialFingerprint?: string; + server: SessionResources['server']; + transport: SessionResources['transport']; + client: SessionResources['client']; + auth: SessionResources['auth']; + }): SessionRecord { + // Convert the admission reservation (if this came through tryReserve). + this.pending = Math.max(0, this.pending - 1); + const t = this.now(); + const record: SessionRecord = { + ...input, + state: 'initializing', + createdAt: t, + lastSeenAt: t, + closed: false, + inflight: 0, + }; + this.sessions.set(input.sessionId, record); + return record; + } + + /** Look up a session and refresh its idle timer. */ + get(sessionId: string): SessionRecord | undefined { + const record = this.sessions.get(sessionId); + if (record) record.lastSeenAt = this.now(); + return record; + } + + /** Look up a session WITHOUT refreshing its idle timer. */ + peek(sessionId: string): SessionRecord | undefined { + return this.sessions.get(sessionId); + } + + markReady(sessionId: string): void { + const record = this.sessions.get(sessionId); + if (record) record.state = 'ready'; + } + + reserveInflight(sessionId: string): boolean { + const record = this.sessions.get(sessionId); + if (!record) return false; + if (record.inflight >= this.opts.maxInflight) return false; + record.inflight += 1; + return true; + } + + releaseInflight(sessionId: string): void { + const record = this.sessions.get(sessionId); + if (record) record.inflight = Math.max(0, record.inflight - 1); + } + + /** + * DELETE path: the SDK already closed the transport (which cascaded to the + * server), so close Horizon resources ONLY and drop the record. + */ + async handleSessionClosed(sessionId: string): Promise { + const record = this.sessions.get(sessionId); + if (!record || record.closed) return; + record.closed = true; + record.state = 'closing'; + this.sessions.delete(sessionId); + await this.closeHorizon(record); + this.opts.onTeardown?.(sessionId, 'delete'); + } + + /** + * TTL / shutdown path: close exactly one MCP primitive (`server.close()`, + * which cascades to the transport) then Horizon resources. Idempotent. + */ + async teardown(sessionId: string, reason: string): Promise { + const record = this.sessions.get(sessionId); + if (!record || record.closed) return; + record.closed = true; + record.state = 'closing'; + // Delete before closing so the cascaded onsessionclosed finds nothing. + this.sessions.delete(sessionId); + try { + await record.server.close(); + } catch { + // best-effort - the closed flag already prevents re-entry + } + await this.closeHorizon(record); + this.opts.onTeardown?.(sessionId, reason); + } + + private async closeHorizon(record: SessionRecord): Promise { + try { + await record.client.close(); + } catch { + // best-effort + } + try { + await record.auth.cleanup(); + } catch { + // best-effort + } + } + + /** Tear down idle- or absolute-expired sessions. Returns the swept ids. */ + async sweepExpired(): Promise { + const t = this.now(); + const expired: string[] = []; + for (const [id, record] of this.sessions) { + if (record.closed) continue; + const idle = t - record.lastSeenAt; + const age = t - record.createdAt; + if (idle >= this.opts.idleTtlMs || age >= this.opts.absTtlMs) { + expired.push(id); + } + } + for (const id of expired) { + await this.teardown(id, 'ttl'); + } + return expired; + } + + /** Tear down every live session (graceful shutdown). */ + async shutdownAll(): Promise { + for (const id of [...this.sessions.keys()]) { + await this.teardown(id, 'shutdown'); + } + } +} diff --git a/src/index.ts b/src/index.ts index 3106ea5..bca7b2c 100644 --- a/src/index.ts +++ b/src/index.ts @@ -1,71 +1,34 @@ #!/usr/bin/env node -import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'; -import pkg from '../package.json'; import { createAuthProvider } from './auth/index.js'; import { HorizonClient } from './client/http.js'; +import { buildHttpConfig } from './http/config.js'; +import { startHttpServer } from './http/server.js'; import { configureLogging, getLogger, setMcpLoggingSink } from './logging.js'; -import { registerAllResources } from './resources/index.js'; -import { loadSettings } from './settings.js'; -import { registerComputationTools } from './tools/assist/computation.js'; -import { registerCryptoTools } from './tools/assist/crypto.js'; -import { registerQueryTools } from './tools/assist/query.js'; -import { registerSystemTools } from './tools/assist/system.js'; -import { registerTranslateTools } from './tools/assist/translate.js'; -import { registerConfigTools } from './tools/config/index.js'; -import { registerDashboardTools } from './tools/dashboards.js'; -import { registerDatasourceTools } from './tools/datasources.js'; -import { registerDiscoveryEventTools } from './tools/discovery-events.js'; -import { registerDiscoveryFeedTools } from './tools/discovery-feed.js'; -import { registerDiscoveryTools } from './tools/discovery.js'; -import { registerDocsTools } from './tools/docs.js'; -import { registerLifecycleTools } from './tools/lifecycle.js'; -import { registerProfileTools } from './tools/profiles.js'; -import { registerReportTools } from './tools/reports.js'; -import { registerTriggerTools } from './tools/triggers.js'; +import { createSessionServer } from './server-factory.js'; +import { type HorizonSettings, loadSettings } from './settings.js'; const logger = getLogger('horizon_mcp.server'); -const SERVER_INSTRUCTIONS = [ - 'MCP server for Evertrust Horizon CLM (certificate lifecycle, RBAC,', - 'discovery, configuration).', - '', - 'Core rules:', - '- Object names are immutable. Ask the user for `name` (and `display_name`', - ' where supported) before any create_* call.', - '- HQL field names are lowercase (contactemail, keytype, valid.until,', - ' registration.date). camelCase causes HQL-001. groupBy/sortedBy are', - ' camelCase (API context).', - '- Ownership queries: call `whoami` first; then', - ' `owner equals "" or team in (...)`.', - '- Lifecycle: call `get_request_template` before `submit_request`.', - ' `revocationReason` is mandatory for revoke.', - '- PKCS#12 lives on the enrollment request response only, never on the', - ' certificate object.', - '', - 'Where to look:', - '- Full rules + workflows: horizon://knowledge/server-rules', - '- Query syntax (HCQL/HRQL/HEQL/HDQL): horizon://knowledge/query-languages', - '- Picking the right tool: horizon://knowledge/tool-selection', -].join('\n'); - -async function main(): Promise { - const settings = loadSettings(); - configureLogging(settings.logLevel); - - const server = new McpServer( - { name: 'Horizon MCP Server', version: pkg.version }, - { - instructions: SERVER_INSTRUCTIONS, - capabilities: { - tools: {}, - resources: {}, - logging: {}, - }, - }, - ); +function installShutdown(close: () => Promise): void { + for (const signal of ['SIGINT', 'SIGTERM'] as const) { + process.on(signal, async () => { + let exitCode = 0; + try { + await close(); + } catch (err) { + logger.error(`Error during shutdown: ${err}`); + exitCode = 1; + } finally { + logger.info('Horizon MCP server shut down.'); + process.exit(exitCode); + } + }); + } +} +async function runStdio(settings: HorizonSettings): Promise { const auth = createAuthProvider(settings); const client = new HorizonClient(settings.url, auth, { timeout: settings.timeout, @@ -75,55 +38,23 @@ async function main(): Promise { warnVersions: settings.warnVersions, }); - // Register all resources - registerAllResources(server); - - // Register all tools by domain - registerProfileTools(server, client); - registerLifecycleTools(server, client); - registerDashboardTools(server, client); - registerDiscoveryTools(server, client); - registerDiscoveryEventTools(server, client); - registerDiscoveryFeedTools(server, client); - registerDatasourceTools(server, client); - registerReportTools(server, client); - registerTriggerTools(server, client); - registerDocsTools(server, client); - registerSystemTools(server, client); - registerQueryTools(server, client); - registerCryptoTools(server, client); - registerComputationTools(server, client); - registerTranslateTools(server, client); - registerConfigTools(server, client); + const server = createSessionServer(client); logger.info( - 'Horizon MCP server ready - auth will trigger on first tool call.', + 'Horizon MCP server ready (stdio) - auth will trigger on first tool call.', ); - // Shutdown lifecycle - for (const signal of ['SIGINT', 'SIGTERM'] as const) { - process.on(signal, async () => { - let exitCode = 0; - try { - await client.close(); - await auth.cleanup(); - } catch (err) { - logger.error(`Error during shutdown: ${err}`); - exitCode = 1; - } finally { - logger.info('Horizon MCP server shut down.'); - process.exit(exitCode); - } - }); - } + installShutdown(async () => { + await client.close(); + await auth.cleanup(); + }); - // Start stdio transport const transport = new StdioServerTransport(); await server.connect(transport); // Forward server logs through `notifications/message` now that the transport - // is connected. Best-effort: any failure (client opted out, transport - // closing) stays local and must never crash the server. + // is connected. Best-effort: any failure stays local and never crashes the + // server. (HTTP mode does NOT use this global sink - it routes per-session.) setMcpLoggingSink((level, payload) => { void Promise.resolve() .then(() => @@ -147,6 +78,29 @@ async function main(): Promise { }); } +async function runHttp(settings: HorizonSettings): Promise { + // Fail-closed: throws (refusing to start) on any malformed HTTP config. + const config = buildHttpConfig(settings); + const handle = await startHttpServer(settings, config); + + logger.info(`Horizon MCP server ready (http) at ${handle.url}`); + + installShutdown(async () => { + await handle.close(); + }); +} + +async function main(): Promise { + const settings = loadSettings(); + configureLogging(settings.logLevel); + + if (settings.transport === 'http') { + await runHttp(settings); + } else { + await runStdio(settings); + } +} + main().catch((err) => { logger.error(`Fatal error: ${err}`); process.exit(1); diff --git a/src/logging.ts b/src/logging.ts index 24e5ab8..0173840 100644 --- a/src/logging.ts +++ b/src/logging.ts @@ -1,3 +1,5 @@ +import { AsyncLocalStorage } from 'node:async_hooks'; + const LOG_LEVELS = { DEBUG: 0, INFO: 1, @@ -46,6 +48,18 @@ export function setMcpLoggingSink(sink: McpSink | undefined): void { mcpSink = sink; } +// Per-session sink override for HTTP mode. A single module-level `mcpSink` +// would let one session's logs leak into another's client stream (last writer +// wins), so HTTP mode never registers a global sink: it wraps each request's +// handling in `runWithLoggingSink`, and `emit()` reads the current session's +// sink from AsyncLocalStorage. The context propagates across awaits within the +// handler, so concurrent sessions stay isolated. +const sessionSinkStore = new AsyncLocalStorage(); + +export function runWithLoggingSink(sink: McpSink, fn: () => T): T { + return sessionSinkStore.run(sink, fn); +} + function emit( level: LogLevel, logger: string, @@ -71,9 +85,12 @@ function emit( process.stderr.write(JSON.stringify(entry) + '\n'); - if (mcpSink) { + // Session sink (HTTP mode, per-request via ALS) takes precedence over the + // global sink (stdio mode, set once). Stderr above always fires regardless. + const activeSink = sessionSinkStore.getStore() ?? mcpSink; + if (activeSink) { try { - mcpSink(MCP_LEVEL[level], { logger, msg, extra }); + activeSink(MCP_LEVEL[level], { logger, msg, extra }); } catch { // best-effort -- swallow sink errors } diff --git a/src/server-factory.ts b/src/server-factory.ts new file mode 100644 index 0000000..3a7dab8 --- /dev/null +++ b/src/server-factory.ts @@ -0,0 +1,87 @@ +import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; + +import pkg from '../package.json'; +import type { HorizonClient } from './client/http.js'; +import { registerAllResources } from './resources/index.js'; +import { registerComputationTools } from './tools/assist/computation.js'; +import { registerCryptoTools } from './tools/assist/crypto.js'; +import { registerQueryTools } from './tools/assist/query.js'; +import { registerSystemTools } from './tools/assist/system.js'; +import { registerTranslateTools } from './tools/assist/translate.js'; +import { registerConfigTools } from './tools/config/index.js'; +import { registerDashboardTools } from './tools/dashboards.js'; +import { registerDatasourceTools } from './tools/datasources.js'; +import { registerDiscoveryEventTools } from './tools/discovery-events.js'; +import { registerDiscoveryFeedTools } from './tools/discovery-feed.js'; +import { registerDiscoveryTools } from './tools/discovery.js'; +import { registerDocsTools } from './tools/docs.js'; +import { registerLifecycleTools } from './tools/lifecycle.js'; +import { registerProfileTools } from './tools/profiles.js'; +import { registerReportTools } from './tools/reports.js'; +import { registerTriggerTools } from './tools/triggers.js'; + +export const SERVER_INSTRUCTIONS = [ + 'MCP server for Evertrust Horizon CLM (certificate lifecycle, RBAC,', + 'discovery, configuration).', + '', + 'Core rules:', + '- Object names are immutable. Ask the user for `name` (and `display_name`', + ' where supported) before any create_* call.', + '- HQL field names are lowercase (contactemail, keytype, valid.until,', + ' registration.date). camelCase causes HQL-001. groupBy/sortedBy are', + ' camelCase (API context).', + '- Ownership queries: call `whoami` first; then', + ' `owner equals "" or team in (...)`.', + '- Lifecycle: call `get_request_template` before `submit_request`.', + ' `revocationReason` is mandatory for revoke.', + '- PKCS#12 lives on the enrollment request response only, never on the', + ' certificate object.', + '', + 'Where to look:', + '- Full rules + workflows: horizon://knowledge/server-rules', + '- Query syntax (HCQL/HRQL/HEQL/HDQL): horizon://knowledge/query-languages', + '- Picking the right tool: horizon://knowledge/tool-selection', +].join('\n'); + +/** + * Build a fully-wired McpServer bound to a single HorizonClient: knowledge + * resources plus every tool domain. Transport-agnostic - stdio builds one at + * startup, HTTP builds one per session so each session's tools close over that + * session's client (no shared client state across sessions). + */ +export function createSessionServer(client: HorizonClient): McpServer { + const server = new McpServer( + { name: 'Horizon MCP Server', version: pkg.version }, + { + instructions: SERVER_INSTRUCTIONS, + capabilities: { + tools: {}, + resources: {}, + logging: {}, + }, + }, + ); + + // Knowledge resources first (mirrors prior startup order). + registerAllResources(server); + + // Tools by domain. + registerProfileTools(server, client); + registerLifecycleTools(server, client); + registerDashboardTools(server, client); + registerDiscoveryTools(server, client); + registerDiscoveryEventTools(server, client); + registerDiscoveryFeedTools(server, client); + registerDatasourceTools(server, client); + registerReportTools(server, client); + registerTriggerTools(server, client); + registerDocsTools(server, client); + registerSystemTools(server, client); + registerQueryTools(server, client); + registerCryptoTools(server, client); + registerComputationTools(server, client); + registerTranslateTools(server, client); + registerConfigTools(server, client); + + return server; +} diff --git a/src/settings.ts b/src/settings.ts index b707c61..69de8ff 100644 --- a/src/settings.ts +++ b/src/settings.ts @@ -1,5 +1,31 @@ import { z } from 'zod'; +// Case-insensitive enum: lowercases the env value before matching, so +// HORIZON_TRANSPORT=HTTP and =http both resolve to 'http'. An unknown value +// fails the parse (fail closed), never silently falls back. +const transportSchema = z + .string() + .default('stdio') + .transform((v) => v.toLowerCase()) + .pipe(z.enum(['stdio', 'http'])); + +const httpAuthModeSchema = z + .string() + .default('service') + .transform((v) => v.toLowerCase()) + .pipe(z.enum(['service', 'api-key', 'mtls'])); + +// Comma-separated env list -> trimmed, non-empty string array. +const csvListSchema = z + .string() + .default('') + .transform((v) => + v + .split(',') + .map((s) => s.trim()) + .filter((s) => s.length > 0), + ); + const settingsSchema = z.object({ url: z.string().default('https://localhost'), apiId: z.string().default(''), @@ -14,12 +40,39 @@ const settingsSchema = z.object({ .string() .default('true') .transform((v) => v.toLowerCase() !== 'false' && v !== '0'), - loginTimeout: z.coerce.number().int().positive().default(300), timeout: z.coerce.number().int().positive().default(30), exportTimeout: z.coerce.number().int().positive().default(120), logLevel: z.string().default('INFO'), testedVersions: z.array(z.string()).default(['2.8']), warnVersions: z.array(z.string()).default(['2.7', '2.9']), + + // -- Streamable HTTP transport ------------------------------------------ + // All HTTP-mode settings. `transport` selects stdio (default) vs http. + // Cross-field validation (host defaults, mtls topology, header names) lives + // in src/http/config.ts and only runs when transport === 'http'. + transport: transportSchema, + httpHost: z.string().default('127.0.0.1'), + httpPort: z.coerce.number().int().positive().default(8080), + httpPath: z.string().default('/mcp'), + publicUrl: z.string().default(''), + trustedHosts: csvListSchema, + trustedOrigins: csvListSchema, + httpAuthMode: httpAuthModeSchema, + sessionIdleTtl: z.coerce.number().int().positive().default(300), + sessionAbsTtl: z.coerce.number().int().positive().default(3600), + maxSessions: z.coerce.number().int().positive().default(256), + maxInflightToolcalls: z.coerce.number().int().positive().default(8), + maxBodyBytes: z.coerce.number().int().positive().default(1048576), + sseMaxDuration: z.coerce.number().int().positive().default(3600), + rateLimitRps: z.coerce.number().int().nonnegative().default(20), + initRateLimit: z.coerce.number().int().nonnegative().default(5), + + // -- Inbound mTLS (only when HORIZON_HTTP_AUTH_MODE=mtls) ---------------- + httpTlsCert: z.string().default(''), + httpTlsKey: z.string().default(''), + inboundCertHeader: z.string().default(''), + trustedProxy: z.string().default(''), + forwardCertHeader: z.string().default('SSL_CLIENT_CERT'), }); export type HorizonSettings = z.infer; diff --git a/tests/unit/auth.test.ts b/tests/unit/auth.test.ts index c9da123..2ed7ac6 100644 --- a/tests/unit/auth.test.ts +++ b/tests/unit/auth.test.ts @@ -1,12 +1,12 @@ -import { existsSync, mkdtempSync, writeFileSync } from 'node:fs'; +import { mkdtempSync, writeFileSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join } from 'node:path'; -import { beforeEach, describe, expect, it, vi } from 'vitest'; +import { beforeEach, describe, expect, it } from 'vitest'; import { ApiKeyAuthProvider } from '../../src/auth/apikey.js'; import { createAuthProvider } from '../../src/auth/index.js'; import { MtlsAuthProvider } from '../../src/auth/mtls.js'; -import { PlaySessionAuthProvider } from '../../src/auth/play-session.js'; +import { loadSettings } from '../../src/settings.js'; import type { HorizonSettings } from '../../src/settings.js'; /** @@ -17,22 +17,8 @@ function makeSettings( overrides: Partial = {}, ): HorizonSettings { return { + ...loadSettings({}), url: 'https://horizon.example.com', - apiId: '', - apiKey: '', - authMode: '', - clientCert: '', - clientKey: '', - clientKeyPassword: '', - clientPfx: '', - clientPfxPassword: '', - verifySsl: true, - loginTimeout: 300, - timeout: 30, - exportTimeout: 120, - logLevel: 'INFO', - testedVersions: ['2.8'], - warnVersions: ['2.7', '2.9'], ...overrides, }; } @@ -293,249 +279,6 @@ describe('MtlsAuthProvider (PFX)', () => { }); }); -// =========================================================================== -// PlaySessionAuthProvider -// =========================================================================== - -describe('PlaySessionAuthProvider', () => { - describe('constructor and initial state', () => { - it('starts in expired state with no cookie', () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - // The provider is newly created, so getHeaders should fail - // because there is no session cookie yet - expect(provider.csrfToken).toBeUndefined(); - }); - - it('accepts a custom login timeout', () => { - const provider = new PlaySessionAuthProvider( - 'https://horizon.test', - true, - 60, - ); - // We can verify this through the factory (tested below) - // but the constructor should not throw - expect(provider).toBeInstanceOf(PlaySessionAuthProvider); - }); - - it('strips trailing slash from horizon URL', () => { - // Just verify it doesn't throw - URL cleanup is internal - const provider = new PlaySessionAuthProvider('https://horizon.test///'); - expect(provider).toBeInstanceOf(PlaySessionAuthProvider); - }); - }); - - describe('getHeaders', () => { - it('throws when no session cookie is available', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - await expect(provider.getHeaders()).rejects.toThrow('No Play session'); - }); - - it('returns Cookie header with PLAY_SESSION when cookie is set', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - // Use internal access to set state for testing - const p = provider as unknown as { - _sessionCookie: string; - _expired: boolean; - }; - p._sessionCookie = 'abc123'; - p._expired = false; - - const headers = await provider.getHeaders(); - expect(headers).toEqual({ Cookie: 'PLAY_SESSION=abc123' }); - }); - - it('includes CSRF cookie when csrf token is set', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - const p = provider as unknown as { - _sessionCookie: string; - _csrfTokenValue: string; - _expired: boolean; - }; - p._sessionCookie = 'abc123'; - p._csrfTokenValue = 'csrf-xyz'; - p._expired = false; - - const headers = await provider.getHeaders(); - expect(headers).toEqual({ - Cookie: 'PLAY_SESSION=abc123; csrf-token=csrf-xyz', - }); - }); - }); - - describe('markAuthFailed', () => { - it('sets expired flag to true', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - const p = provider as unknown as { - _sessionCookie: string; - _expired: boolean; - }; - p._expired = false; - p._sessionCookie = 'abc123'; - - await provider.markAuthFailed(); - expect(p._expired).toBe(true); - }); - }); - - describe('csrfToken property', () => { - it('returns undefined when no CSRF token', () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - expect(provider.csrfToken).toBeUndefined(); - }); - - it('returns the CSRF value when set', () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - const p = provider as unknown as { _csrfTokenValue: string }; - p._csrfTokenValue = 'csrf-abc'; - expect(provider.csrfToken).toBe('csrf-abc'); - }); - }); - - describe('refreshIfNeeded', () => { - it('triggers _acquireSession when expired', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - const acquireMock = vi.fn().mockResolvedValue(undefined); - // Replace _acquireSession with a mock - ( - provider as unknown as { _acquireSession: () => Promise } - )._acquireSession = acquireMock; - - await provider.refreshIfNeeded(); - expect(acquireMock).toHaveBeenCalledOnce(); - }); - - it('skips _acquireSession when not expired and cookie exists', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - const p = provider as unknown as { - _sessionCookie: string; - _expired: boolean; - _acquireSession: () => Promise; - }; - p._expired = false; - p._sessionCookie = 'abc123'; - - const acquireMock = vi.fn().mockResolvedValue(undefined); - p._acquireSession = acquireMock; - - await provider.refreshIfNeeded(); - expect(acquireMock).not.toHaveBeenCalled(); - }); - }); - - describe('playwright import error', () => { - it('throws a clear message when playwright is not installed', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - - // Mock the static method to throw ImportError - const original = PlaySessionAuthProvider['_checkPlaywrightAvailable']; - PlaySessionAuthProvider['_checkPlaywrightAvailable'] = () => { - throw new Error( - 'Play session auth requires Playwright. ' + - 'Install: npm install playwright && npx playwright install chromium', - ); - }; - - try { - await expect(provider.refreshIfNeeded()).rejects.toThrow( - 'Play session auth requires Playwright', - ); - } finally { - PlaySessionAuthProvider['_checkPlaywrightAvailable'] = original; - } - }); - }); - - describe('chromium not installed', () => { - it('wraps browser-missing error with clear message', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - - // Mock playwright check to pass - const origCheck = PlaySessionAuthProvider['_checkPlaywrightAvailable']; - PlaySessionAuthProvider['_checkPlaywrightAvailable'] = () => - Promise.resolve(); - - // Instead of going through the full flow, directly test the error - // wrapping logic by mocking at a higher level - const mockAcquire = vi - .fn() - .mockRejectedValue( - new Error( - 'Chromium browser not found. Run: npx playwright install chromium', - ), - ); - ( - provider as unknown as { _acquireSession: () => Promise } - )._acquireSession = mockAcquire; - - try { - await expect(provider.refreshIfNeeded()).rejects.toThrow( - 'Chromium browser not found', - ); - } finally { - PlaySessionAuthProvider['_checkPlaywrightAvailable'] = origCheck; - } - }); - }); - - describe('cleanup', () => { - it('removes a tracked temp profile dir and clears the field', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - const dir = makeTmpDir(); - writeFileSync(join(dir, 'marker'), 'x'); - const p = provider as unknown as { _userDataDir: string | undefined }; - p._userDataDir = dir; - - await provider.cleanup(); - - expect(existsSync(dir)).toBe(false); - expect(p._userDataDir).toBeUndefined(); - }); - - it('is a no-op when no temp dir is tracked', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - await expect(provider.cleanup()).resolves.toBeUndefined(); - }); - - it('is idempotent and does not throw if the dir is already gone', async () => { - const provider = new PlaySessionAuthProvider('https://horizon.test'); - const dir = makeTmpDir(); - const p = provider as unknown as { _userDataDir: string | undefined }; - p._userDataDir = dir; - - await provider.cleanup(); - p._userDataDir = dir; - await expect(provider.cleanup()).resolves.toBeUndefined(); - expect(existsSync(dir)).toBe(false); - }); - }); - - describe('navigation error', () => { - it('wraps navigation failure with connectivity hint', async () => { - const provider = new PlaySessionAuthProvider( - 'https://unreachable.invalid', - ); - - // Mock _acquireSession to throw the expected wrapped error - const mockAcquire = vi - .fn() - .mockRejectedValue( - new Error( - 'Failed to navigate to https://unreachable.invalid. ' + - 'Check HORIZON_URL and network connectivity. ' + - '(Error: net::ERR_NAME_NOT_RESOLVED)', - ), - ); - ( - provider as unknown as { _acquireSession: () => Promise } - )._acquireSession = mockAcquire; - - await expect(provider.refreshIfNeeded()).rejects.toThrow( - 'Failed to navigate', - ); - }); - }); -}); - // =========================================================================== // createAuthProvider (factory) // =========================================================================== @@ -600,20 +343,12 @@ describe('createAuthProvider (factory)', () => { }); }); - describe('Play Session fallback', () => { - it('falls back to PlaySessionAuthProvider when no certs or API key', () => { + describe('no credentials configured', () => { + it('throws a clear error when no certs or API key are set', () => { const settings = makeSettings(); - const provider = createAuthProvider(settings); - expect(provider).toBeInstanceOf(PlaySessionAuthProvider); - }); - - it('passes login_timeout from settings to PlaySessionAuthProvider', () => { - const settings = makeSettings({ loginTimeout: 42 }); - const provider = createAuthProvider(settings); - expect(provider).toBeInstanceOf(PlaySessionAuthProvider); - // Verify the timeout was passed through - const p = provider as unknown as { _loginTimeout: number }; - expect(p._loginTimeout).toBe(42); + expect(() => createAuthProvider(settings)).toThrow( + /No Horizon credentials configured/i, + ); }); }); @@ -665,7 +400,7 @@ describe('createAuthProvider (factory)', () => { ); }); - it('prefers API key over Play Session when apiId is set', () => { + it('selects API key when only apiId is set', () => { const settings = makeSettings({ apiId: 'my-id', apiKey: 'my-key', diff --git a/tests/unit/cert-forward.test.ts b/tests/unit/cert-forward.test.ts new file mode 100644 index 0000000..1ad8e3d --- /dev/null +++ b/tests/unit/cert-forward.test.ts @@ -0,0 +1,47 @@ +import { describe, expect, it } from 'vitest'; + +import { CertForwardAuthProvider } from '../../src/auth/cert-forward.js'; + +const PEM = + '-----BEGIN CERTIFICATE-----\nMIIBdummycertbody==\n-----END CERTIFICATE-----\n'; + +describe('CertForwardAuthProvider', () => { + it('forwards the cert as a URL-encoded PEM in the configured header', async () => { + const provider = new CertForwardAuthProvider('SSL_CLIENT_CERT', PEM); + const headers = await provider.getHeaders(); + expect(headers).toEqual({ SSL_CLIENT_CERT: encodeURIComponent(PEM) }); + }); + + it('preserves a custom forward header name', async () => { + const provider = new CertForwardAuthProvider( + 'X-Forwarded-Client-Cert', + PEM, + ); + const headers = await provider.getHeaders(); + expect(Object.keys(headers)).toEqual(['X-Forwarded-Client-Cert']); + }); + + it('rejects input that is not a PEM certificate', () => { + expect( + () => new CertForwardAuthProvider('SSL_CLIENT_CERT', 'nonsense'), + ).toThrow(/PEM certificate/i); + }); + + it('returns a fresh headers object on each call (no shared mutation)', async () => { + const provider = new CertForwardAuthProvider('SSL_CLIENT_CERT', PEM); + const a = await provider.getHeaders(); + const b = await provider.getHeaders(); + expect(a).not.toBe(b); + expect(a).toEqual(b); + }); + + it('does not present a client cert on the MCP->Horizon hop (header only)', () => { + const provider = new CertForwardAuthProvider('SSL_CLIENT_CERT', PEM); + expect(provider.getDispatcherOptions()).toBeUndefined(); + }); + + it('refreshIfNeeded is a no-op', async () => { + const provider = new CertForwardAuthProvider('SSL_CLIENT_CERT', PEM); + await expect(provider.refreshIfNeeded()).resolves.toBeUndefined(); + }); +}); diff --git a/tests/unit/client-validate-auth.test.ts b/tests/unit/client-validate-auth.test.ts new file mode 100644 index 0000000..ac99891 --- /dev/null +++ b/tests/unit/client-validate-auth.test.ts @@ -0,0 +1,115 @@ +import { beforeEach, describe, expect, it, vi } from 'vitest'; + +import { ApiKeyAuthProvider } from '../../src/auth/apikey.js'; +import { HorizonError } from '../../src/client/errors.js'; + +// Mock undici before importing HorizonClient. +const mockFetch = vi.fn<(...args: unknown[]) => Promise>(); + +vi.mock('undici', () => ({ + fetch: (...args: unknown[]) => mockFetch(...args), + Agent: class MockAgent { + close() { + return Promise.resolve(); + } + }, + FormData: class MockFormData { + append() {} + }, +})); + +const { HorizonClient } = await import('../../src/client/http.js'); + +function fakeResponse(status: number, body: unknown): Response { + const bodyText = typeof body === 'string' ? body : JSON.stringify(body); + return { + status, + ok: status >= 200 && status < 300, + headers: new Headers(), + json: () => + Promise.resolve(typeof body === 'string' ? JSON.parse(body) : body), + text: () => Promise.resolve(bodyText), + clone() { + return fakeResponse(status, body); + }, + arrayBuffer: () => Promise.resolve(new ArrayBuffer(0)), + } as unknown as Response; +} + +function makeClient() { + return new HorizonClient( + 'https://horizon.test', + new ApiKeyAuthProvider('id', 'key'), + { + timeout: 5, + exportTimeout: 120, + verifySsl: false, + }, + ); +} + +function initializedFlag(client: unknown): boolean { + return (client as Record)['_initialized']; +} + +describe('HorizonClient.validateAuth', () => { + beforeEach(() => mockFetch.mockReset()); + + it('captures the principal + version on a 200 whoami and marks the client initialized', async () => { + const client = makeClient(); + mockFetch + .mockResolvedValueOnce(fakeResponse(200, { token: 'csrf-1' })) // CSRF + .mockResolvedValueOnce( + fakeResponse(200, { + identity: { identifier: 'alice' }, + _horizonVersion: '2.10.0', + }), + ); // whoami + + await client.validateAuth(); + + expect(client.principalName).toBe('alice'); + expect(client.horizonVersion).toBe('2.10.0'); + expect(initializedFlag(client)).toBe(true); + }); + + it('does not re-initialize on the first tool call after validateAuth', async () => { + const client = makeClient(); + mockFetch + .mockResolvedValueOnce(fakeResponse(200, { token: 'csrf-1' })) + .mockResolvedValueOnce( + fakeResponse(200, { identity: { identifier: 'alice' } }), + ); + await client.validateAuth(); + + // A subsequent GET must not trigger a second CSRF/whoami round-trip. + mockFetch.mockResolvedValueOnce(fakeResponse(200, { ok: true })); + await client.get('/api/v1/anything'); + + expect(mockFetch).toHaveBeenCalledTimes(3); // csrf + whoami + the GET + }); + + it('throws on a non-200 whoami and leaves the client uninitialized', async () => { + const client = makeClient(); + mockFetch + .mockResolvedValueOnce(fakeResponse(200, { token: 'csrf-1' })) + .mockResolvedValueOnce(fakeResponse(401, { error: 'SecAuth001' })); + + await expect(client.validateAuth()).rejects.toBeInstanceOf(HorizonError); + expect(initializedFlag(client)).toBe(false); + }); + + it('throws when whoami is unreachable and leaves the client uninitialized', async () => { + const client = makeClient(); + mockFetch + .mockResolvedValueOnce(fakeResponse(200, { token: 'csrf-1' })) + .mockRejectedValueOnce( + Object.assign(new TypeError('fetch failed'), { + cause: { code: 'ECONNREFUSED' }, + }), + ); + + await expect(client.validateAuth()).rejects.toThrow(); + expect(initializedFlag(client)).toBe(false); + }); +}); diff --git a/tests/unit/fingerprint.test.ts b/tests/unit/fingerprint.test.ts new file mode 100644 index 0000000..c005e38 --- /dev/null +++ b/tests/unit/fingerprint.test.ts @@ -0,0 +1,59 @@ +import { describe, expect, it } from 'vitest'; + +import { + credentialFingerprint, + fingerprintsMatch, + shortFingerprint, +} from '../../src/http/fingerprint.js'; + +describe('credentialFingerprint', () => { + it('is deterministic within a process', () => { + expect(credentialFingerprint('id:key')).toBe( + credentialFingerprint('id:key'), + ); + }); + + it('differs for different credentials', () => { + expect(credentialFingerprint('id:key')).not.toBe( + credentialFingerprint('id:other'), + ); + }); + + it('produces a 64-char hex sha256 digest', () => { + expect(credentialFingerprint('id:key')).toMatch(/^[0-9a-f]{64}$/); + }); + + it('is keyed, not a bare hash of the input', () => { + // A bare sha256 of "id:key" is a fixed public value; a keyed HMAC under a + // per-process random key must not equal it. + const bareSha256 = + '936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af'; + expect(credentialFingerprint('hello')).not.toBe(bareSha256); + }); +}); + +describe('fingerprintsMatch', () => { + it('matches identical fingerprints', () => { + const fp = credentialFingerprint('id:key'); + expect(fingerprintsMatch(fp, fp)).toBe(true); + }); + + it('rejects different fingerprints', () => { + expect( + fingerprintsMatch(credentialFingerprint('a'), credentialFingerprint('b')), + ).toBe(false); + }); + + it('returns false (does not throw) on a length mismatch', () => { + expect(fingerprintsMatch('abcd', credentialFingerprint('a'))).toBe(false); + }); +}); + +describe('shortFingerprint', () => { + it('returns a truncated prefix safe for logs', () => { + const fp = credentialFingerprint('id:key'); + const short = shortFingerprint(fp); + expect(short.length).toBeLessThan(fp.length); + expect(fp.startsWith(short)).toBe(true); + }); +}); diff --git a/tests/unit/http-config.test.ts b/tests/unit/http-config.test.ts new file mode 100644 index 0000000..eb22cc5 --- /dev/null +++ b/tests/unit/http-config.test.ts @@ -0,0 +1,276 @@ +import { describe, expect, it } from 'vitest'; + +import { buildHttpConfig } from '../../src/http/config.js'; +import { loadSettings } from '../../src/settings.js'; + +/** + * Build an HttpConfig from a flat env map. Defaults to http transport and + * api-key auth mode (which needs no env credential), so host/path tests do + * not have to supply a service credential. + */ +function build(env: Record) { + const full = { + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'api-key', + ...env, + }; + return buildHttpConfig(loadSettings(full), full); +} + +describe('buildHttpConfig', () => { + describe('host derivation', () => { + it('derives loopback hosts for the bound port when nothing is set', () => { + const cfg = build({}); + expect(cfg.allowedHosts).toEqual( + new Set(['localhost:8080', '127.0.0.1:8080', '[::1]:8080']), + ); + }); + + it('uses the bound port in the derived loopback hosts', () => { + const cfg = build({ HORIZON_HTTP_PORT: '9443' }); + expect(cfg.allowedHosts).toEqual( + new Set(['localhost:9443', '127.0.0.1:9443', '[::1]:9443']), + ); + }); + + it('refuses to start on a non-loopback bind with no public URL or trusted hosts', () => { + expect(() => build({ HORIZON_HTTP_HOST: '0.0.0.0' })).toThrow( + /non-loopback|HORIZON_PUBLIC_URL|HORIZON_TRUSTED_HOSTS/i, + ); + }); + + it('allows a non-loopback bind when trusted hosts are given', () => { + const cfg = build({ + HORIZON_HTTP_HOST: '0.0.0.0', + HORIZON_TRUSTED_HOSTS: 'mcp.example.com', + }); + expect(cfg.allowedHosts).toEqual(new Set(['mcp.example.com'])); + }); + + it('derives the allowed host from the public URL', () => { + const cfg = build({ + HORIZON_HTTP_HOST: '0.0.0.0', + HORIZON_PUBLIC_URL: 'https://mcp.example.com', + }); + expect(cfg.allowedHosts).toEqual(new Set(['mcp.example.com'])); + expect(cfg.publicEndpoint).toBe('https://mcp.example.com/mcp'); + }); + + it('keeps the port when the public URL carries one', () => { + const cfg = build({ + HORIZON_HTTP_HOST: '0.0.0.0', + HORIZON_PUBLIC_URL: 'https://mcp.example.com:8443', + }); + expect(cfg.allowedHosts).toEqual(new Set(['mcp.example.com:8443'])); + }); + + it('lets trusted hosts override public-URL derivation', () => { + const cfg = build({ + HORIZON_HTTP_HOST: '0.0.0.0', + HORIZON_PUBLIC_URL: 'https://mcp.example.com', + HORIZON_TRUSTED_HOSTS: 'a.internal, b.internal', + }); + expect(cfg.allowedHosts).toEqual(new Set(['a.internal', 'b.internal'])); + }); + + it('rejects a malformed public URL', () => { + expect(() => build({ HORIZON_PUBLIC_URL: 'not a url' })).toThrow( + /HORIZON_PUBLIC_URL/i, + ); + }); + + it('rejects a non-http(s) public URL', () => { + expect(() => + build({ HORIZON_PUBLIC_URL: 'ftp://mcp.example.com' }), + ).toThrow(/HORIZON_PUBLIC_URL/i); + }); + }); + + describe('endpoint path', () => { + it('keeps a simple absolute path', () => { + expect(build({}).path).toBe('/mcp'); + }); + + it('normalizes a trailing slash', () => { + expect(build({ HORIZON_HTTP_PATH: '/mcp/' }).path).toBe('/mcp'); + }); + + it('keeps the root path as-is', () => { + expect(build({ HORIZON_HTTP_PATH: '/' }).path).toBe('/'); + }); + + it('rejects a path without a leading slash', () => { + expect(() => build({ HORIZON_HTTP_PATH: 'mcp' })).toThrow( + /HORIZON_HTTP_PATH/i, + ); + }); + + it('rejects a path with a query string', () => { + expect(() => build({ HORIZON_HTTP_PATH: '/mcp?x=1' })).toThrow( + /HORIZON_HTTP_PATH/i, + ); + }); + + it('rejects a path with a fragment', () => { + expect(() => build({ HORIZON_HTTP_PATH: '/mcp#frag' })).toThrow( + /HORIZON_HTTP_PATH/i, + ); + }); + }); + + describe('origins', () => { + it('defaults to no allowed origins', () => { + expect(build({}).allowedOrigins).toEqual(new Set()); + }); + + it('canonicalizes configured origins', () => { + const cfg = build({ + HORIZON_TRUSTED_ORIGINS: + 'https://app.example.com, https://b.example.com', + }); + expect(cfg.allowedOrigins).toEqual( + new Set(['https://app.example.com', 'https://b.example.com']), + ); + }); + + it('rejects a malformed origin', () => { + expect(() => + build({ HORIZON_TRUSTED_ORIGINS: 'http://ok.com, nonsense' }), + ).toThrow(/origin/i); + }); + + it('rejects a non-http(s) origin scheme', () => { + expect(() => + build({ HORIZON_TRUSTED_ORIGINS: 'ftp://x.example.com' }), + ).toThrow(/origin|http/i); + }); + }); + + describe('auth mode: service', () => { + it('requires an env credential', () => { + expect(() => + buildHttpConfig( + loadSettings({ + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'service', + }), + {}, + ), + ).toThrow(/service.*credential|credential.*service/i); + }); + + it('accepts a service mode with an API key env credential', () => { + const cfg = buildHttpConfig( + loadSettings({ + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'service', + HORIZON_API_ID: 'id', + HORIZON_API_KEY: 'key', + }), + {}, + ); + expect(cfg.authMode).toBe('service'); + }); + }); + + describe('auth mode: mtls', () => { + function mtls(env: Record) { + const full = { + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'mtls', + ...env, + }; + return buildHttpConfig(loadSettings(full), full); + } + + it('requires a TLS listener or an inbound cert header', () => { + expect(() => mtls({})).toThrow(/mtls/i); + }); + + it('accepts the MCP-terminates-TLS topology', () => { + const cfg = mtls({ + HORIZON_HTTP_TLS_CERT: '/tls/cert.pem', + HORIZON_HTTP_TLS_KEY: '/tls/key.pem', + }); + expect(cfg.mtls?.listener).toEqual({ + certPath: '/tls/cert.pem', + keyPath: '/tls/key.pem', + }); + expect(cfg.mtls?.forwardHeader).toBe('SSL_CLIENT_CERT'); + }); + + it('rejects a TLS listener with only one of cert/key', () => { + expect(() => mtls({ HORIZON_HTTP_TLS_CERT: '/tls/cert.pem' })).toThrow( + /HORIZON_HTTP_TLS_KEY|cert.*key/i, + ); + }); + + it('accepts the trusted-ingress topology', () => { + const cfg = mtls({ + HORIZON_INBOUND_CERT_HEADER: 'x-client-cert', + HORIZON_TRUSTED_PROXY: '10.0.0.0/8', + }); + expect(cfg.mtls?.inbound).toEqual({ + header: 'x-client-cert', + trustedProxy: '10.0.0.0/8', + }); + }); + + it('requires a trusted proxy with an inbound cert header', () => { + expect(() => + mtls({ HORIZON_INBOUND_CERT_HEADER: 'x-client-cert' }), + ).toThrow(/HORIZON_TRUSTED_PROXY/i); + }); + + it('rejects a malformed trusted proxy', () => { + expect(() => + mtls({ + HORIZON_INBOUND_CERT_HEADER: 'x-client-cert', + HORIZON_TRUSTED_PROXY: 'not-an-ip', + }), + ).toThrow(/HORIZON_TRUSTED_PROXY/i); + }); + + it('rejects configuring both topologies at once', () => { + expect(() => + mtls({ + HORIZON_HTTP_TLS_CERT: '/tls/cert.pem', + HORIZON_HTTP_TLS_KEY: '/tls/key.pem', + HORIZON_INBOUND_CERT_HEADER: 'x-client-cert', + HORIZON_TRUSTED_PROXY: '10.0.0.0/8', + }), + ).toThrow(/either|both|not both/i); + }); + + it('rejects a forbidden forward header name', () => { + expect(() => + mtls({ + HORIZON_HTTP_TLS_CERT: '/tls/cert.pem', + HORIZON_HTTP_TLS_KEY: '/tls/key.pem', + HORIZON_FORWARD_CERT_HEADER: 'authorization', + }), + ).toThrow(/header/i); + }); + + it('rejects an invalid header token', () => { + expect(() => + mtls({ + HORIZON_INBOUND_CERT_HEADER: 'bad header name', + HORIZON_TRUSTED_PROXY: '10.0.0.0/8', + }), + ).toThrow(/header/i); + }); + }); + + describe('fail-closed extras', () => { + it('rejects HORIZON_ALLOW_PRIVATE_TLS_PROBE=1 in HTTP mode', () => { + expect(() => build({ HORIZON_ALLOW_PRIVATE_TLS_PROBE: '1' })).toThrow( + /HORIZON_ALLOW_PRIVATE_TLS_PROBE/i, + ); + }); + + it('allows HORIZON_ALLOW_PRIVATE_TLS_PROBE unset', () => { + expect(() => build({})).not.toThrow(); + }); + }); +}); diff --git a/tests/unit/http-credentials.test.ts b/tests/unit/http-credentials.test.ts new file mode 100644 index 0000000..7c4d998 --- /dev/null +++ b/tests/unit/http-credentials.test.ts @@ -0,0 +1,252 @@ +import { describe, expect, it } from 'vitest'; + +import { ApiKeyAuthProvider } from '../../src/auth/apikey.js'; +import { CertForwardAuthProvider } from '../../src/auth/cert-forward.js'; +import type { HttpConfig } from '../../src/http/config.js'; +import { + CredentialError, + buildSessionAuth, + decodeForwardedCert, + extractCredential, + peerMatchesProxy, +} from '../../src/http/credentials.js'; +import { credentialFingerprint } from '../../src/http/fingerprint.js'; +import { loadSettings } from '../../src/settings.js'; + +const PEM = + '-----BEGIN CERTIFICATE-----\nMIIBdummy==\n-----END CERTIFICATE-----\n'; + +function cfg(over: Partial): HttpConfig { + return { + host: '127.0.0.1', + port: 8080, + path: '/mcp', + publicEndpoint: 'http://127.0.0.1:8080/mcp', + allowedHosts: new Set(['127.0.0.1:8080']), + allowedOrigins: new Set(), + authMode: 'service', + ...over, + }; +} + +function req( + headers: Record, + socket: Record = {}, +) { + return { headers: { ...headers }, socket } as never; +} + +describe('peerMatchesProxy', () => { + it('matches an exact IPv4 address', () => { + expect(peerMatchesProxy('10.0.0.5', '10.0.0.5')).toBe(true); + expect(peerMatchesProxy('10.0.0.6', '10.0.0.5')).toBe(false); + }); + + it('matches an IPv4 CIDR range', () => { + expect(peerMatchesProxy('10.1.2.3', '10.0.0.0/8')).toBe(true); + expect(peerMatchesProxy('11.0.0.1', '10.0.0.0/8')).toBe(false); + }); + + it('normalizes IPv4-mapped IPv6 peers', () => { + expect(peerMatchesProxy('::ffff:10.0.0.5', '10.0.0.0/8')).toBe(true); + }); + + it('returns false for a missing remote address', () => { + expect(peerMatchesProxy(undefined, '10.0.0.0/8')).toBe(false); + }); + + it('returns false for an out-of-range CIDR prefix', () => { + expect(peerMatchesProxy('10.0.0.1', '10.0.0.0/40')).toBe(false); + }); +}); + +describe('decodeForwardedCert', () => { + it('decodes a URL-encoded PEM (nginx $ssl_client_escaped_cert)', () => { + expect(decodeForwardedCert(encodeURIComponent(PEM))).toContain( + 'BEGIN CERTIFICATE', + ); + }); + + it('accepts a raw PEM', () => { + expect(decodeForwardedCert(PEM)).toContain('BEGIN CERTIFICATE'); + }); + + it('wraps a base64 DER value into PEM', () => { + const b64 = Buffer.from('dummy-der-bytes').toString('base64'); + expect(decodeForwardedCert(b64)).toContain('BEGIN CERTIFICATE'); + }); +}); + +describe('extractCredential', () => { + describe('service mode', () => { + it('accepts a request with no client credential', () => { + const m = extractCredential(req({}), cfg({ authMode: 'service' })); + expect(m.kind).toBe('service'); + }); + + it('rejects a client-supplied API key', () => { + expect(() => + extractCredential( + req({ 'x-api-id': 'id', 'x-api-key': 'k' }), + cfg({ authMode: 'service' }), + ), + ).toThrow(CredentialError); + }); + + it('rejects a client-supplied cert header', () => { + expect(() => + extractCredential( + req({ 'x-forwarded-client-cert': PEM }), + cfg({ authMode: 'service' }), + ), + ).toThrow(CredentialError); + }); + + it('rejects a client-supplied Authorization header', () => { + expect(() => + extractCredential( + req({ authorization: 'Bearer x' }), + cfg({ authMode: 'service' }), + ), + ).toThrow(CredentialError); + }); + + it('rejects a client-supplied Cookie header', () => { + expect(() => + extractCredential( + req({ cookie: 'session=x' }), + cfg({ authMode: 'service' }), + ), + ).toThrow(CredentialError); + }); + }); + + describe('api-key mode', () => { + it('extracts the API key headers', () => { + const m = extractCredential( + req({ 'x-api-id': 'id', 'x-api-key': 'secret' }), + cfg({ authMode: 'api-key' }), + ); + expect(m).toEqual({ kind: 'api-key', apiId: 'id', apiKey: 'secret' }); + }); + + it('rejects a missing API key', () => { + expect(() => + extractCredential( + req({ 'x-api-id': 'id' }), + cfg({ authMode: 'api-key' }), + ), + ).toThrow(CredentialError); + }); + }); + + describe('mtls mode (inbound header topology)', () => { + const inboundCfg = cfg({ + authMode: 'mtls', + mtls: { + forwardHeader: 'SSL_CLIENT_CERT', + inbound: { header: 'x-client-cert', trustedProxy: '10.0.0.0/8' }, + }, + }); + + it('extracts the cert when the peer is the trusted proxy', () => { + const m = extractCredential( + req( + { 'x-client-cert': encodeURIComponent(PEM) }, + { remoteAddress: '10.0.0.9' }, + ), + inboundCfg, + ); + expect(m.kind).toBe('cert'); + }); + + it('rejects the inbound cert from an untrusted peer', () => { + expect(() => + extractCredential( + req( + { 'x-client-cert': encodeURIComponent(PEM) }, + { remoteAddress: '192.168.1.1' }, + ), + inboundCfg, + ), + ).toThrow(CredentialError); + }); + + it('rejects a missing cert header', () => { + expect(() => + extractCredential(req({}, { remoteAddress: '10.0.0.9' }), inboundCfg), + ).toThrow(CredentialError); + }); + }); + + describe('mtls mode (TLS listener topology)', () => { + const listenerCfg = cfg({ + authMode: 'mtls', + mtls: { + forwardHeader: 'SSL_CLIENT_CERT', + listener: { certPath: '/c', keyPath: '/k' }, + }, + }); + + it('extracts the presented peer certificate', () => { + const m = extractCredential( + req({}, { getPeerCertificate: () => ({ raw: Buffer.from('der') }) }), + listenerCfg, + ); + expect(m.kind).toBe('cert'); + }); + + it('rejects when no client certificate was presented', () => { + expect(() => + extractCredential( + req({}, { getPeerCertificate: () => ({}) }), + listenerCfg, + ), + ).toThrow(CredentialError); + }); + }); +}); + +describe('buildSessionAuth', () => { + it('service mode uses the env credential and binds no fingerprint', () => { + const settings = loadSettings({ + HORIZON_API_ID: 'env', + HORIZON_API_KEY: 'k', + }); + const { auth, fingerprint } = buildSessionAuth( + { kind: 'service' }, + cfg({ authMode: 'service' }), + settings, + ); + expect(auth).toBeInstanceOf(ApiKeyAuthProvider); + expect(fingerprint).toBeUndefined(); + }); + + it('api-key mode builds an ApiKeyAuthProvider with a credential fingerprint', () => { + const settings = loadSettings({}); + const { auth, fingerprint } = buildSessionAuth( + { kind: 'api-key', apiId: 'id', apiKey: 'secret' }, + cfg({ authMode: 'api-key' }), + settings, + ); + expect(auth).toBeInstanceOf(ApiKeyAuthProvider); + expect(fingerprint).toBe(credentialFingerprint('id:secret')); + }); + + it('mtls mode builds a CertForwardAuthProvider with a cert fingerprint', () => { + const settings = loadSettings({}); + const { auth, fingerprint } = buildSessionAuth( + { kind: 'cert', pem: PEM }, + cfg({ + authMode: 'mtls', + mtls: { + forwardHeader: 'SSL_CLIENT_CERT', + listener: { certPath: '/c', keyPath: '/k' }, + }, + }), + settings, + ); + expect(auth).toBeInstanceOf(CertForwardAuthProvider); + expect(fingerprint).toBe(credentialFingerprint(PEM)); + }); +}); diff --git a/tests/unit/http-headers.test.ts b/tests/unit/http-headers.test.ts new file mode 100644 index 0000000..88d8b9e --- /dev/null +++ b/tests/unit/http-headers.test.ts @@ -0,0 +1,110 @@ +import { describe, expect, it } from 'vitest'; + +import { + DEFAULT_SENSITIVE_HEADERS, + buildSensitiveHeaderSet, + scrubSensitiveHeaders, +} from '../../src/http/headers.js'; + +interface FakeReq { + headers: Record; + rawHeaders: string[]; +} + +function fakeReq( + headers: Record, + rawHeaders: string[], +): FakeReq { + return { headers: { ...headers }, rawHeaders: [...rawHeaders] }; +} + +describe('DEFAULT_SENSITIVE_HEADERS', () => { + it('covers the standard credential + cert headers', () => { + for (const name of [ + 'x-api-id', + 'x-api-key', + 'authorization', + 'proxy-authorization', + 'cookie', + 'set-cookie', + 'csrf-token', + 'ssl-client-cert', + 'ssl_client_cert', + 'x-forwarded-client-cert', + 'x-forwarded-tls-client-cert', + ]) { + expect(DEFAULT_SENSITIVE_HEADERS.has(name)).toBe(true); + } + }); +}); + +describe('buildSensitiveHeaderSet', () => { + it('adds configured headers, lowercased', () => { + const set = buildSensitiveHeaderSet(['X-Client-Cert', 'SSL_CLIENT_CERT']); + expect(set.has('x-client-cert')).toBe(true); + expect(set.has('ssl_client_cert')).toBe(true); + // Still includes the defaults. + expect(set.has('authorization')).toBe(true); + }); +}); + +describe('scrubSensitiveHeaders', () => { + it('removes sensitive headers from req.headers (case-insensitive)', () => { + const req = fakeReq( + { + 'x-api-id': 'id', + 'x-api-key': 'secret', + 'content-type': 'application/json', + }, + [ + 'X-API-ID', + 'id', + 'X-API-KEY', + 'secret', + 'Content-Type', + 'application/json', + ], + ); + scrubSensitiveHeaders(req, DEFAULT_SENSITIVE_HEADERS); + expect(req.headers['x-api-id']).toBeUndefined(); + expect(req.headers['x-api-key']).toBeUndefined(); + expect(req.headers['content-type']).toBe('application/json'); + }); + + it('also removes them from rawHeaders (what @hono/node-server reads)', () => { + const req = fakeReq( + { authorization: 'Bearer x', accept: 'text/event-stream' }, + ['Authorization', 'Bearer x', 'Accept', 'text/event-stream'], + ); + scrubSensitiveHeaders(req, DEFAULT_SENSITIVE_HEADERS); + expect(req.rawHeaders).toEqual(['Accept', 'text/event-stream']); + }); + + it('scrubs a configured cert header from both views', () => { + const set = buildSensitiveHeaderSet(['X-Client-Cert']); + const req = fakeReq({ 'x-client-cert': 'PEM', host: 'mcp:8080' }, [ + 'X-Client-Cert', + 'PEM', + 'Host', + 'mcp:8080', + ]); + scrubSensitiveHeaders(req, set); + expect(req.headers['x-client-cert']).toBeUndefined(); + expect(req.rawHeaders).toEqual(['Host', 'mcp:8080']); + }); + + it('leaves protocol headers like Mcp-Session-Id intact', () => { + const req = fakeReq( + { 'mcp-session-id': 'abc', accept: 'text/event-stream' }, + ['Mcp-Session-Id', 'abc', 'Accept', 'text/event-stream'], + ); + scrubSensitiveHeaders(req, DEFAULT_SENSITIVE_HEADERS); + expect(req.headers['mcp-session-id']).toBe('abc'); + expect(req.rawHeaders).toEqual([ + 'Mcp-Session-Id', + 'abc', + 'Accept', + 'text/event-stream', + ]); + }); +}); diff --git a/tests/unit/http-jsonrpc.test.ts b/tests/unit/http-jsonrpc.test.ts new file mode 100644 index 0000000..492ec8e --- /dev/null +++ b/tests/unit/http-jsonrpc.test.ts @@ -0,0 +1,72 @@ +import { describe, expect, it } from 'vitest'; + +import { + firstId, + jsonRpcErrorBody, + messagesOf, + methodsOf, + validateInitialize, +} from '../../src/http/jsonrpc.js'; + +describe('messagesOf', () => { + it('wraps a single object', () => { + expect(messagesOf({ method: 'x' })).toEqual([{ method: 'x' }]); + }); + it('passes an array through', () => { + expect(messagesOf([{ method: 'a' }, { method: 'b' }])).toHaveLength(2); + }); + it('treats null/undefined as empty', () => { + expect(messagesOf(undefined)).toEqual([]); + expect(messagesOf(null)).toEqual([]); + }); +}); + +describe('methodsOf', () => { + it('extracts methods, ignoring non-method entries', () => { + expect(methodsOf([{ method: 'tools/call' }, { id: 1 }])).toEqual([ + 'tools/call', + ]); + }); +}); + +describe('firstId', () => { + it('returns the first message id', () => { + expect(firstId({ id: 7, method: 'initialize' })).toBe(7); + }); + it('returns null when there is no id', () => { + expect(firstId({ method: 'x' })).toBeNull(); + }); +}); + +describe('validateInitialize', () => { + it('accepts a single initialize message', () => { + expect(validateInitialize({ method: 'initialize', id: 1 }).ok).toBe(true); + }); + it('rejects an empty body', () => { + expect(validateInitialize(undefined).ok).toBe(false); + }); + it('rejects a batch', () => { + expect( + validateInitialize([ + { method: 'initialize', id: 1 }, + { method: 'initialize', id: 2 }, + ]).ok, + ).toBe(false); + }); + it('rejects a first message that is not initialize', () => { + expect(validateInitialize({ method: 'tools/list', id: 1 }).ok).toBe(false); + }); +}); + +describe('jsonRpcErrorBody', () => { + it('builds a JSON-RPC error envelope echoing the id', () => { + expect(jsonRpcErrorBody(5, -32600, 'bad')).toEqual({ + jsonrpc: '2.0', + id: 5, + error: { code: -32600, message: 'bad' }, + }); + }); + it('defaults a missing id to null', () => { + expect(jsonRpcErrorBody(undefined, -32600, 'bad').id).toBeNull(); + }); +}); diff --git a/tests/unit/http-middleware.test.ts b/tests/unit/http-middleware.test.ts new file mode 100644 index 0000000..f5c131a --- /dev/null +++ b/tests/unit/http-middleware.test.ts @@ -0,0 +1,49 @@ +import { describe, expect, it } from 'vitest'; + +import { isHostAllowed, isOriginAllowed } from '../../src/http/middleware.js'; + +describe('isHostAllowed', () => { + const allowed = new Set(['mcp.example.com', '127.0.0.1:8080']); + + it('accepts an allowed host', () => { + expect(isHostAllowed('mcp.example.com', allowed)).toBe(true); + expect(isHostAllowed('127.0.0.1:8080', allowed)).toBe(true); + }); + + it('is case-insensitive and tolerates a trailing dot', () => { + expect(isHostAllowed('MCP.Example.com', allowed)).toBe(true); + expect(isHostAllowed('mcp.example.com.', allowed)).toBe(true); + }); + + it('rejects a host not in the allow-list', () => { + expect(isHostAllowed('evil.example.com', allowed)).toBe(false); + }); + + it('rejects a missing Host header', () => { + expect(isHostAllowed(undefined, allowed)).toBe(false); + }); +}); + +describe('isOriginAllowed', () => { + const allowed = new Set(['https://app.example.com']); + + it('allows a request with no Origin (non-browser MCP client)', () => { + expect(isOriginAllowed(undefined, allowed)).toBe(true); + }); + + it('allows a listed Origin', () => { + expect(isOriginAllowed('https://app.example.com', allowed)).toBe(true); + }); + + it('is case-insensitive on the Origin value', () => { + expect(isOriginAllowed('https://APP.example.com', allowed)).toBe(true); + }); + + it('rejects an unlisted Origin', () => { + expect(isOriginAllowed('https://evil.example.com', allowed)).toBe(false); + }); + + it('rejects any Origin when none are configured', () => { + expect(isOriginAllowed('https://app.example.com', new Set())).toBe(false); + }); +}); diff --git a/tests/unit/http-rate-limit.test.ts b/tests/unit/http-rate-limit.test.ts new file mode 100644 index 0000000..83e4581 --- /dev/null +++ b/tests/unit/http-rate-limit.test.ts @@ -0,0 +1,91 @@ +import { describe, expect, it } from 'vitest'; + +import { RateLimiter } from '../../src/http/rate-limit.js'; + +function fakeClock(start = 1_000) { + let t = start; + return { + now: () => t, + advance: (ms: number) => { + t += ms; + }, + }; +} + +describe('RateLimiter', () => { + it('allows everything when the limit is 0 (disabled)', () => { + const rl = new RateLimiter(0); + for (let i = 0; i < 100; i++) expect(rl.tryAcquire('k')).toBe(true); + }); + + it('allows up to the limit then denies within a window', () => { + const clock = fakeClock(); + const rl = new RateLimiter(3, clock.now); + expect(rl.tryAcquire('k')).toBe(true); + expect(rl.tryAcquire('k')).toBe(true); + expect(rl.tryAcquire('k')).toBe(true); + expect(rl.tryAcquire('k')).toBe(false); + }); + + it('resets after the 1s window elapses', () => { + const clock = fakeClock(); + const rl = new RateLimiter(1, clock.now); + expect(rl.tryAcquire('k')).toBe(true); + expect(rl.tryAcquire('k')).toBe(false); + clock.advance(1000); + expect(rl.tryAcquire('k')).toBe(true); + }); + + it('counts a batch as its message count (cost)', () => { + const clock = fakeClock(); + const rl = new RateLimiter(5, clock.now); + expect(rl.tryAcquire('k', 5)).toBe(true); + expect(rl.tryAcquire('k', 1)).toBe(false); + }); + + it('isolates counts per key', () => { + const clock = fakeClock(); + const rl = new RateLimiter(1, clock.now); + expect(rl.tryAcquire('a')).toBe(true); + expect(rl.tryAcquire('b')).toBe(true); + expect(rl.tryAcquire('a')).toBe(false); + }); + + describe('tryAcquireAll (atomic over multiple keys)', () => { + it('denies and consumes nothing if any key is full', () => { + const clock = fakeClock(); + const rl = new RateLimiter(1, clock.now); + // Fill the global key. + expect(rl.tryAcquire('global')).toBe(true); + // Atomic check across global + a fresh per-address key fails on global... + expect(rl.tryAcquireAll(['global', '10.0.0.1'])).toBe(false); + // ...and must not have consumed the per-address budget. + expect(rl.tryAcquire('10.0.0.1')).toBe(true); + }); + + it('allows and consumes when all keys have capacity', () => { + const clock = fakeClock(); + const rl = new RateLimiter(2, clock.now); + expect(rl.tryAcquireAll(['global', 'addr'])).toBe(true); + expect(rl.tryAcquireAll(['global', 'addr'])).toBe(true); + expect(rl.tryAcquireAll(['global', 'addr'])).toBe(false); + }); + }); + + describe('prune', () => { + it('evicts windows whose period has elapsed (bounds the key map)', () => { + const clock = fakeClock(); + const rl = new RateLimiter(5, clock.now); + rl.tryAcquire('peer-1'); + rl.tryAcquire('peer-2'); + const windows = (rl as unknown as { windows: Map }) + .windows; + expect(windows.size).toBe(2); + rl.prune(); // still within the window -> nothing evicted + expect(windows.size).toBe(2); + clock.advance(1000); + rl.prune(); // window elapsed -> both evicted + expect(windows.size).toBe(0); + }); + }); +}); diff --git a/tests/unit/http-server.integration.test.ts b/tests/unit/http-server.integration.test.ts new file mode 100644 index 0000000..b8601c2 --- /dev/null +++ b/tests/unit/http-server.integration.test.ts @@ -0,0 +1,299 @@ +import { createServer } from 'node:http'; +import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'; + +// Mock undici (the SERVER's Horizon client). The MCP CLIENT transport uses the +// global fetch, which is untouched, so real HTTP flows client -> server while +// Horizon is faked. The faked whoami echoes the X-API-ID the session forwards. +const mockFetch = vi.fn<(...args: unknown[]) => Promise>(); + +vi.mock('undici', () => ({ + fetch: (...args: unknown[]) => mockFetch(...args), + Agent: class { + close() { + return Promise.resolve(); + } + }, + FormData: class { + append() {} + }, +})); + +const { startHttpServer } = await import('../../src/http/server.js'); +const { buildHttpConfig } = await import('../../src/http/config.js'); +const { loadSettings } = await import('../../src/settings.js'); +const { Client } = await import('@modelcontextprotocol/sdk/client/index.js'); +const { StreamableHTTPClientTransport } = + await import('@modelcontextprotocol/sdk/client/streamableHttp.js'); + +function fakeResponse(status: number, body: unknown): Response { + const text = typeof body === 'string' ? body : JSON.stringify(body); + return { + status, + ok: status >= 200 && status < 300, + headers: new Headers(), + json: () => + Promise.resolve(typeof body === 'string' ? JSON.parse(body) : body), + text: () => Promise.resolve(text), + clone() { + return fakeResponse(status, body); + }, + arrayBuffer: () => Promise.resolve(new ArrayBuffer(0)), + } as unknown as Response; +} + +function apiIdOf(init: unknown): string | undefined { + const headers = (init as { headers?: Record } | undefined) + ?.headers; + return headers?.['X-API-ID'] ?? headers?.['x-api-id']; +} + +mockFetch.mockImplementation((url: unknown, init: unknown) => { + const u = String(url); + if (u.includes('/api/v1/security/csrf')) { + return Promise.resolve(fakeResponse(200, { token: 'csrf' })); + } + if (u.includes('/api/v1/security/principals/self')) { + const id = apiIdOf(init) ?? 'anonymous'; + return Promise.resolve( + fakeResponse(200, { + identifier: id, + name: id, + _horizonVersion: '2.10.0', + }), + ); + } + return Promise.resolve(fakeResponse(200, {})); +}); + +async function freePort(): Promise { + return new Promise((resolve, reject) => { + const s = createServer(); + s.once('error', reject); + s.listen(0, '127.0.0.1', () => { + const addr = s.address(); + const port = typeof addr === 'object' && addr ? addr.port : 0; + s.close(() => resolve(port)); + }); + }); +} + +interface ServerCtx { + base: string; + handle: Awaited>; +} + +async function startApiKeyServer(): Promise { + const port = await freePort(); + const env = { + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'api-key', + HORIZON_URL: 'https://horizon.test', + HORIZON_HTTP_HOST: '127.0.0.1', + HORIZON_HTTP_PORT: String(port), + HORIZON_TRUSTED_HOSTS: `127.0.0.1:${port},localhost:${port}`, + HORIZON_VERIFY_SSL: 'false', + }; + const settings = loadSettings(env); + const config = buildHttpConfig(settings, env); + const handle = await startHttpServer(settings, config); + return { base: `http://127.0.0.1:${handle.port}/mcp`, handle }; +} + +function makeClient(base: string, apiId?: string, apiKey?: string) { + const headers: Record = {}; + if (apiId) headers['X-API-ID'] = apiId; + if (apiKey) headers['X-API-KEY'] = apiKey; + const transport = new StreamableHTTPClientTransport(new URL(base), { + requestInit: { headers }, + }); + const client = new Client({ name: 'itest', version: '0.0.0' }); + return { client, transport }; +} + +describe('HTTP server integration (api-key mode)', () => { + let ctx: ServerCtx; + const openClients: Array<{ close: () => Promise }> = []; + + beforeEach(async () => { + ctx = await startApiKeyServer(); + }); + + afterEach(async () => { + for (const c of openClients.splice(0)) { + await c.close().catch(() => undefined); + } + await ctx.handle.close().catch(() => undefined); + }); + + it('completes initialize -> ready and exposes tools + knowledge resources', async () => { + const { client, transport } = makeClient(ctx.base, 'alice', 'ka'); + openClients.push(client); + await client.connect(transport); + + const tools = await client.listTools(); + expect(tools.tools.some((t) => t.name === 'whoami')).toBe(true); + expect( + tools.tools.some((t) => t.name === 'create_certificate_profile'), + ).toBe(true); + + const resources = await client.listResources(); + expect( + resources.resources.some( + (r) => r.uri === 'horizon://knowledge/server-rules', + ), + ).toBe(true); + }, 20000); + + it('isolates two concurrent sessions with distinct identities', async () => { + const a = makeClient(ctx.base, 'alice', 'ka'); + const b = makeClient(ctx.base, 'bob', 'kb'); + openClients.push(a.client, b.client); + await Promise.all([ + a.client.connect(a.transport), + b.client.connect(b.transport), + ]); + + const [ra, rb] = await Promise.all([ + a.client.callTool({ name: 'whoami', arguments: {} }), + b.client.callTool({ name: 'whoami', arguments: {} }), + ]); + + expect((ra.structuredContent as { identifier: string }).identifier).toBe( + 'alice', + ); + expect((rb.structuredContent as { identifier: string }).identifier).toBe( + 'bob', + ); + }, 20000); + + it('rejects an initialize with no credential', async () => { + const { client, transport } = makeClient(ctx.base); + openClients.push(client); + await expect(client.connect(transport)).rejects.toThrow(); + }, 20000); + + it('rejects a request that replays a session id with a different credential', async () => { + const a = makeClient(ctx.base, 'alice', 'ka'); + openClients.push(a.client); + await a.client.connect(a.transport); + const sid = a.transport.sessionId!; + expect(sid).toBeTruthy(); + + // Forge a request: A's session id, B's credential -> must be rejected. + const res = await fetch(ctx.base, { + method: 'POST', + headers: { + 'Content-Type': 'application/json', + Accept: 'application/json, text/event-stream', + 'Mcp-Session-Id': sid, + 'X-API-ID': 'bob', + 'X-API-KEY': 'kb', + }, + body: JSON.stringify({ jsonrpc: '2.0', id: 99, method: 'tools/list' }), + }); + expect(res.status).toBe(401); + }, 20000); + + it('tears down all sessions on close', async () => { + const a = makeClient(ctx.base, 'alice', 'ka'); + openClients.push(a.client); + await a.client.connect(a.transport); + expect(ctx.handle.sessions.size).toBe(1); + + await ctx.handle.close(); + expect(ctx.handle.sessions.size).toBe(0); + }, 20000); +}); + +describe('HTTP server integration (service mode rejects client creds)', () => { + it('rejects a client that supplies its own API key in service mode', async () => { + const port = await freePort(); + const env = { + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'service', + HORIZON_URL: 'https://horizon.test', + HORIZON_API_ID: 'service-acct', + HORIZON_API_KEY: 'service-key', + HORIZON_HTTP_HOST: '127.0.0.1', + HORIZON_HTTP_PORT: String(port), + HORIZON_TRUSTED_HOSTS: `127.0.0.1:${port}`, + HORIZON_VERIFY_SSL: 'false', + }; + const settings = loadSettings(env); + const config = buildHttpConfig(settings, env); + const handle = await startHttpServer(settings, config); + const base = `http://127.0.0.1:${handle.port}/mcp`; + try { + const res = await fetch(base, { + method: 'POST', + headers: { + 'Content-Type': 'application/json', + Accept: 'application/json, text/event-stream', + 'X-API-ID': 'sneaky', + 'X-API-KEY': 'sneaky', + }, + body: JSON.stringify({ + jsonrpc: '2.0', + id: 1, + method: 'initialize', + params: { + protocolVersion: '2025-06-18', + capabilities: {}, + clientInfo: { name: 'x', version: '0' }, + }, + }), + }); + expect(res.status).toBe(400); + } finally { + await handle.close(); + } + }, 20000); +}); + +describe('HTTP server integration (no leak on a rejected initialize)', () => { + it('releases the admission reservation when the SDK rejects a credentialed initialize', async () => { + const port = await freePort(); + const env = { + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'api-key', + HORIZON_URL: 'https://horizon.test', + HORIZON_HTTP_HOST: '127.0.0.1', + HORIZON_HTTP_PORT: String(port), + HORIZON_TRUSTED_HOSTS: `127.0.0.1:${port},localhost:${port}`, + HORIZON_MAX_SESSIONS: '2', + HORIZON_VERIFY_SSL: 'false', + }; + const settings = loadSettings(env); + const config = buildHttpConfig(settings, env); + const handle = await startHttpServer(settings, config); + const base = `http://127.0.0.1:${handle.port}/mcp`; + try { + // Each body passes the local initialize check but fails the SDK JSON-RPC + // schema (no jsonrpc/id), so onsessioninitialized never fires. Send more + // than maxSessions: if the reservation leaked, these would exhaust the cap + // and the valid client below would be locked out with a 503. + for (let i = 0; i < 3; i++) { + const res = await fetch(base, { + method: 'POST', + headers: { + 'Content-Type': 'application/json', + Accept: 'application/json, text/event-stream', + 'X-API-ID': 'alice', + 'X-API-KEY': 'ka', + }, + body: JSON.stringify({ method: 'initialize' }), + }); + expect(res.status).toBeGreaterThanOrEqual(400); + } + expect(handle.sessions.size).toBe(0); + + // The reservations were released, so a real client still connects. + const a = makeClient(base, 'alice', 'ka'); + await a.client.connect(a.transport); + expect(handle.sessions.size).toBe(1); + await a.client.close().catch(() => undefined); + } finally { + await handle.close(); + } + }, 20000); +}); diff --git a/tests/unit/http-session-manager.test.ts b/tests/unit/http-session-manager.test.ts new file mode 100644 index 0000000..a99fb92 --- /dev/null +++ b/tests/unit/http-session-manager.test.ts @@ -0,0 +1,205 @@ +import { describe, expect, it } from 'vitest'; + +import { SessionManager } from '../../src/http/session-manager.js'; + +function fakeResources() { + const calls = { server: 0, transport: 0, client: 0, auth: 0 }; + return { + calls, + server: { + close: async () => { + calls.server++; + }, + }, + transport: { + close: async () => { + calls.transport++; + }, + }, + client: { + close: async () => { + calls.client++; + }, + }, + auth: { + cleanup: async () => { + calls.auth++; + }, + }, + }; +} + +function makeManager( + over: Partial[0]> = {}, +) { + return new SessionManager({ + maxSessions: 256, + idleTtlMs: 300_000, + absTtlMs: 3_600_000, + maxInflight: 8, + ...over, + }); +} + +function add(mgr: SessionManager, id: string, fp?: string) { + const r = fakeResources(); + mgr.create({ + sessionId: id, + server: r.server, + transport: r.transport, + client: r.client, + auth: r.auth, + credentialFingerprint: fp, + }); + return r; +} + +describe('SessionManager basics', () => { + it('tracks size and enforces maxSessions', () => { + const mgr = makeManager({ maxSessions: 2 }); + expect(mgr.canCreate()).toBe(true); + add(mgr, 's1'); + add(mgr, 's2'); + expect(mgr.size).toBe(2); + expect(mgr.canCreate()).toBe(false); + }); + + it('reserves admission capacity atomically across pending initializes', () => { + const mgr = makeManager({ maxSessions: 2 }); + expect(mgr.tryReserve()).toBe(true); + expect(mgr.tryReserve()).toBe(true); + // Both slots reserved (no live sessions yet) -> at capacity. + expect(mgr.tryReserve()).toBe(false); + expect(mgr.canCreate()).toBe(false); + }); + + it('create() converts a reservation without double counting', () => { + const mgr = makeManager({ maxSessions: 1 }); + expect(mgr.tryReserve()).toBe(true); + add(mgr, 's1'); // create() converts the reservation + expect(mgr.size).toBe(1); + expect(mgr.canCreate()).toBe(false); + expect(mgr.tryReserve()).toBe(false); + }); + + it('releaseReservation frees a reservation that never became a session', () => { + const mgr = makeManager({ maxSessions: 1 }); + expect(mgr.tryReserve()).toBe(true); + expect(mgr.canCreate()).toBe(false); + mgr.releaseReservation(); + expect(mgr.canCreate()).toBe(true); + expect(mgr.tryReserve()).toBe(true); + }); + + it('transitions state to ready on markReady', () => { + const mgr = makeManager(); + add(mgr, 's1'); + expect(mgr.peek('s1')?.state).toBe('initializing'); + mgr.markReady('s1'); + expect(mgr.peek('s1')?.state).toBe('ready'); + }); + + it('reserves and releases inflight up to the max', () => { + const mgr = makeManager({ maxInflight: 2 }); + add(mgr, 's1'); + expect(mgr.reserveInflight('s1')).toBe(true); + expect(mgr.reserveInflight('s1')).toBe(true); + expect(mgr.reserveInflight('s1')).toBe(false); + mgr.releaseInflight('s1'); + expect(mgr.reserveInflight('s1')).toBe(true); + }); +}); + +describe('teardown discipline', () => { + it('DELETE path closes Horizon resources only, never an MCP primitive', async () => { + const mgr = makeManager(); + const r = add(mgr, 's1'); + await mgr.handleSessionClosed('s1'); + expect(r.calls.client).toBe(1); + expect(r.calls.auth).toBe(1); + expect(r.calls.server).toBe(0); // SDK already closed the transport+server + expect(r.calls.transport).toBe(0); + expect(mgr.size).toBe(0); + }); + + it('DELETE path is idempotent', async () => { + const mgr = makeManager(); + const r = add(mgr, 's1'); + await mgr.handleSessionClosed('s1'); + await mgr.handleSessionClosed('s1'); + expect(r.calls.client).toBe(1); + expect(r.calls.auth).toBe(1); + }); + + it('TTL path closes exactly one MCP primitive (server) then Horizon', async () => { + const mgr = makeManager(); + const r = add(mgr, 's1'); + await mgr.teardown('s1', 'ttl'); + expect(r.calls.server).toBe(1); // cascades to transport in the SDK + expect(r.calls.transport).toBe(0); // we never close both + expect(r.calls.client).toBe(1); + expect(r.calls.auth).toBe(1); + expect(mgr.size).toBe(0); + }); + + it('TTL path is idempotent (guarded by the closed flag)', async () => { + const mgr = makeManager(); + const r = add(mgr, 's1'); + await mgr.teardown('s1', 'ttl'); + await mgr.teardown('s1', 'ttl'); + expect(r.calls.server).toBe(1); + expect(r.calls.client).toBe(1); + }); + + it('a cascaded onsessionclosed after teardown does not double-clean', async () => { + const mgr = makeManager(); + const r = add(mgr, 's1'); + await mgr.teardown('s1', 'ttl'); + await mgr.handleSessionClosed('s1'); // the cascade + expect(r.calls.client).toBe(1); + expect(r.calls.auth).toBe(1); + expect(r.calls.server).toBe(1); + }); +}); + +describe('sweepExpired', () => { + it('tears down idle-expired sessions', async () => { + let t = 1000; + const mgr = makeManager({ idleTtlMs: 100, absTtlMs: 10_000, now: () => t }); + const r = add(mgr, 's1'); + t = 1050; + expect(await mgr.sweepExpired()).toEqual([]); // idle 50 < 100 + t = 1200; + expect(await mgr.sweepExpired()).toEqual(['s1']); // idle 200 >= 100 + expect(r.calls.server).toBe(1); + expect(mgr.size).toBe(0); + }); + + it('tears down absolute-expired sessions even when recently active', async () => { + let t = 1000; + const mgr = makeManager({ + idleTtlMs: 10_000, + absTtlMs: 1000, + now: () => t, + }); + add(mgr, 's1'); + t = 1500; + mgr.get('s1'); // refresh lastSeenAt -> idle stays low + t = 2001; + expect(await mgr.sweepExpired()).toEqual(['s1']); // age 1001 >= 1000 + }); +}); + +describe('shutdownAll', () => { + it('tears down every live session', async () => { + const mgr = makeManager(); + const r1 = add(mgr, 's1'); + const r2 = add(mgr, 's2'); + await mgr.shutdownAll(); + expect(mgr.size).toBe(0); + expect(r1.calls.server).toBe(1); + expect(r2.calls.server).toBe(1); + expect(r1.calls.client).toBe(1); + expect(r2.calls.client).toBe(1); + }); +}); diff --git a/tests/unit/logging.test.ts b/tests/unit/logging.test.ts new file mode 100644 index 0000000..3ee12d4 --- /dev/null +++ b/tests/unit/logging.test.ts @@ -0,0 +1,92 @@ +import { afterEach, describe, expect, it } from 'vitest'; + +import { + getLogger, + runWithLoggingSink, + setMcpLoggingSink, +} from '../../src/logging.js'; + +afterEach(() => { + // Never leak a global sink between tests. + setMcpLoggingSink(undefined); +}); + +describe('logging sink routing', () => { + it('routes logs to the active session sink', () => { + const sessionLogs: string[] = []; + const log = getLogger('test'); + runWithLoggingSink( + (_level, p) => sessionLogs.push(p.msg), + () => log.info('hello'), + ); + expect(sessionLogs).toEqual(['hello']); + }); + + it('does not leak a session sink outside its scope', () => { + const sessionLogs: string[] = []; + const log = getLogger('test'); + runWithLoggingSink( + (_level, p) => sessionLogs.push(p.msg), + () => log.info('inside'), + ); + log.info('outside'); + expect(sessionLogs).toEqual(['inside']); + }); + + it('keeps two concurrent session sinks isolated across awaits', async () => { + const a: string[] = []; + const b: string[] = []; + const log = getLogger('iso'); + + async function sessionA(): Promise { + log.info('a1'); + await new Promise((r) => setTimeout(r, 5)); + log.info('a2'); + } + async function sessionB(): Promise { + log.info('b1'); + await new Promise((r) => setTimeout(r, 5)); + log.info('b2'); + } + + await Promise.all([ + runWithLoggingSink((_level, p) => a.push(p.msg), sessionA), + runWithLoggingSink((_level, p) => b.push(p.msg), sessionB), + ]); + + expect(a).toEqual(['a1', 'a2']); + expect(b).toEqual(['b1', 'b2']); + }); + + it('prefers the session sink over a global sink', () => { + const globalLogs: string[] = []; + const sessionLogs: string[] = []; + setMcpLoggingSink((_level, p) => globalLogs.push(p.msg)); + const log = getLogger('test'); + runWithLoggingSink( + (_level, p) => sessionLogs.push(p.msg), + () => log.info('scoped'), + ); + expect(sessionLogs).toEqual(['scoped']); + expect(globalLogs).toEqual([]); + }); + + it('falls back to the global sink outside a session scope', () => { + const globalLogs: string[] = []; + setMcpLoggingSink((_level, p) => globalLogs.push(p.msg)); + getLogger('test').info('global'); + expect(globalLogs).toContain('global'); + }); + + it('swallows session sink errors', () => { + const log = getLogger('test'); + expect(() => + runWithLoggingSink( + () => { + throw new Error('boom'); + }, + () => log.info('x'), + ), + ).not.toThrow(); + }); +}); diff --git a/tests/unit/server-factory.test.ts b/tests/unit/server-factory.test.ts new file mode 100644 index 0000000..c246e2b --- /dev/null +++ b/tests/unit/server-factory.test.ts @@ -0,0 +1,73 @@ +import { Client } from '@modelcontextprotocol/sdk/client/index.js'; +import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'; +import { describe, expect, it, vi } from 'vitest'; + +import type { HorizonClient } from '../../src/client/http.js'; +import { createSessionServer } from '../../src/server-factory.js'; + +function mockClient(): HorizonClient { + return { + get: vi.fn().mockResolvedValue({}), + post: vi.fn().mockResolvedValue({}), + put: vi.fn().mockResolvedValue({}), + patch: vi.fn().mockResolvedValue({}), + delete: vi.fn().mockResolvedValue(null), + getBytes: vi.fn().mockResolvedValue(new ArrayBuffer(0)), + getText: vi.fn().mockResolvedValue(''), + postText: vi.fn().mockResolvedValue(''), + postMultipart: vi.fn().mockResolvedValue({}), + request: vi.fn().mockResolvedValue(new Response()), + close: vi.fn().mockResolvedValue(undefined), + fetchCsrfToken: vi.fn().mockResolvedValue(undefined), + exportTimeout: 120000, + principalName: undefined, + horizonVersion: undefined, + } as unknown as HorizonClient; +} + +async function connect(server: ReturnType) { + const [clientTransport, serverTransport] = + InMemoryTransport.createLinkedPair(); + const client = new Client({ name: 'test', version: '0.0.0' }); + await Promise.all([ + client.connect(clientTransport), + server.connect(serverTransport), + ]); + return client; +} + +describe('createSessionServer', () => { + it('registers the full tool set, including the config CRUD tools', async () => { + const server = createSessionServer(mockClient()); + const client = await connect(server); + try { + const { tools } = await client.listTools(); + const names = tools.map((t) => t.name); + + // Core tools from several domains. + expect(names).toContain('whoami'); + expect(names).toContain('search_certificates'); + expect(names).toContain('list_profiles'); + // Config CRUD tools (the suite omitted from golden's registerAllTools). + expect(names).toContain('create_certificate_profile'); + expect(names).toContain('list_service_accounts'); + + // The full surface is large; guard against a domain silently dropping. + expect(tools.length).toBeGreaterThan(150); + } finally { + await client.close(); + } + }); + + it('exposes the knowledge resources (not only tools)', async () => { + const server = createSessionServer(mockClient()); + const client = await connect(server); + try { + const { resources } = await client.listResources(); + const uris = resources.map((r) => r.uri); + expect(uris).toContain('horizon://knowledge/server-rules'); + } finally { + await client.close(); + } + }); +}); diff --git a/tests/unit/settings.test.ts b/tests/unit/settings.test.ts index ce982ab..1fa1b45 100644 --- a/tests/unit/settings.test.ts +++ b/tests/unit/settings.test.ts @@ -12,7 +12,6 @@ describe('loadSettings', () => { expect(settings.apiKey).toBe(''); expect(settings.verifySsl).toBe(true); expect(settings.timeout).toBe(30); - expect(settings.loginTimeout).toBe(300); expect(settings.exportTimeout).toBe(120); expect(settings.logLevel).toBe('INFO'); expect(settings.clientCert).toBe(''); @@ -108,11 +107,6 @@ describe('loadSettings', () => { expect(settings.timeout).toBe(60); }); - it('coerces string to number for LOGIN_TIMEOUT', () => { - const settings = loadSettings({ HORIZON_LOGIN_TIMEOUT: '600' }); - expect(settings.loginTimeout).toBe(600); - }); - it('coerces string to number for EXPORT_TIMEOUT', () => { const settings = loadSettings({ HORIZON_EXPORT_TIMEOUT: '240' }); expect(settings.exportTimeout).toBe(240); @@ -178,4 +172,116 @@ describe('loadSettings', () => { expect(settings.apiId).toBe('my-id'); }); }); + + describe('HTTP transport settings', () => { + it('defaults to stdio transport with safe HTTP defaults', () => { + const s = loadSettings({}); + expect(s.transport).toBe('stdio'); + expect(s.httpHost).toBe('127.0.0.1'); + expect(s.httpPort).toBe(8080); + expect(s.httpPath).toBe('/mcp'); + expect(s.publicUrl).toBe(''); + expect(s.trustedHosts).toEqual([]); + expect(s.trustedOrigins).toEqual([]); + expect(s.httpAuthMode).toBe('service'); + expect(s.sessionIdleTtl).toBe(300); + expect(s.sessionAbsTtl).toBe(3600); + expect(s.maxSessions).toBe(256); + expect(s.maxInflightToolcalls).toBe(8); + expect(s.maxBodyBytes).toBe(1048576); + expect(s.sseMaxDuration).toBe(3600); + expect(s.rateLimitRps).toBe(20); + expect(s.initRateLimit).toBe(5); + expect(s.httpTlsCert).toBe(''); + expect(s.httpTlsKey).toBe(''); + expect(s.inboundCertHeader).toBe(''); + expect(s.trustedProxy).toBe(''); + expect(s.forwardCertHeader).toBe('SSL_CLIENT_CERT'); + }); + + it('reads HORIZON_TRANSPORT=http', () => { + expect(loadSettings({ HORIZON_TRANSPORT: 'http' }).transport).toBe( + 'http', + ); + }); + + it('lowercases the transport value', () => { + expect(loadSettings({ HORIZON_TRANSPORT: 'HTTP' }).transport).toBe( + 'http', + ); + }); + + it('rejects an invalid transport', () => { + expect(() => loadSettings({ HORIZON_TRANSPORT: 'grpc' })).toThrow(); + }); + + it('reads and lowercases the HTTP auth mode', () => { + expect( + loadSettings({ HORIZON_HTTP_AUTH_MODE: 'mtls' }).httpAuthMode, + ).toBe('mtls'); + expect( + loadSettings({ HORIZON_HTTP_AUTH_MODE: 'API-KEY' }).httpAuthMode, + ).toBe('api-key'); + }); + + it('rejects an invalid HTTP auth mode', () => { + expect(() => loadSettings({ HORIZON_HTTP_AUTH_MODE: 'oidc' })).toThrow(); + }); + + it('parses trusted hosts and origins as trimmed comma lists', () => { + const s = loadSettings({ + HORIZON_TRUSTED_HOSTS: 'mcp.example.com, mcp.example.com:8443 ', + HORIZON_TRUSTED_ORIGINS: 'https://app.example.com', + }); + expect(s.trustedHosts).toEqual([ + 'mcp.example.com', + 'mcp.example.com:8443', + ]); + expect(s.trustedOrigins).toEqual(['https://app.example.com']); + }); + + it('drops empty entries from comma lists', () => { + const s = loadSettings({ HORIZON_TRUSTED_HOSTS: 'a.com,, ,b.com,' }); + expect(s.trustedHosts).toEqual(['a.com', 'b.com']); + }); + + it('coerces numeric HTTP settings', () => { + const s = loadSettings({ + HORIZON_HTTP_PORT: '9443', + HORIZON_MAX_SESSIONS: '16', + HORIZON_MAX_BODY_BYTES: '2097152', + }); + expect(s.httpPort).toBe(9443); + expect(s.maxSessions).toBe(16); + expect(s.maxBodyBytes).toBe(2097152); + }); + + it('allows 0 to disable the rate limits', () => { + const s = loadSettings({ + HORIZON_RATE_LIMIT_RPS: '0', + HORIZON_INIT_RATE_LIMIT: '0', + }); + expect(s.rateLimitRps).toBe(0); + expect(s.initRateLimit).toBe(0); + }); + + it('rejects a non-numeric port', () => { + expect(() => loadSettings({ HORIZON_HTTP_PORT: 'abc' })).toThrow(); + }); + + it('reads the inbound/forward mTLS header settings', () => { + const s = loadSettings({ + HORIZON_HTTP_TLS_CERT: '/tls/cert.pem', + HORIZON_HTTP_TLS_KEY: '/tls/key.pem', + HORIZON_INBOUND_CERT_HEADER: 'x-client-cert', + HORIZON_TRUSTED_PROXY: '10.0.0.0/8', + HORIZON_FORWARD_CERT_HEADER: 'SSL_CLIENT_CERT', + }); + expect(s.httpTlsCert).toBe('/tls/cert.pem'); + expect(s.httpTlsKey).toBe('/tls/key.pem'); + expect(s.inboundCertHeader).toBe('x-client-cert'); + expect(s.trustedProxy).toBe('10.0.0.0/8'); + expect(s.forwardCertHeader).toBe('SSL_CLIENT_CERT'); + }); + }); }); diff --git a/tsup.config.ts b/tsup.config.ts index 0717723..fc86da9 100644 --- a/tsup.config.ts +++ b/tsup.config.ts @@ -12,6 +12,4 @@ export default defineConfig({ // Plain imports (import x from "./file.md") work with this loader. // Do NOT use ?raw suffix - that is a Vite convention, not supported here. loader: { '.md': 'text' }, - // Playwright is an optional dep - never bundle it - external: ['playwright'], }); From 94b43c2a07128ed436efb7e7610fa074dbd43ff7 Mon Sep 17 00:00:00 2001 From: Souf Date: Wed, 1 Jul 2026 10:23:22 +0200 Subject: [PATCH 02/12] fix: harden HTTP rate limiting (per-IP limit + readyz cache); refresh doc snapshots --- README.md | 1 + bun.lock | 9 +- package.json | 1 + src/generated/docs/api-doc-pages.json | 62 +- src/generated/docs/companion-doc-pages.json | 2817 ++---- src/generated/docs/doc-versions.json | 31 +- src/generated/docs/product-doc-pages.json | 9589 +------------------ src/http/server.ts | 47 +- src/settings.ts | 1 + tests/unit/http-server.integration.test.ts | 36 + tests/unit/settings.test.ts | 1 + 11 files changed, 926 insertions(+), 11669 deletions(-) diff --git a/README.md b/README.md index 9499614..422441a 100644 --- a/README.md +++ b/README.md @@ -133,6 +133,7 @@ These variables apply only when `HORIZON_TRANSPORT=http`; in stdio mode they are | `HORIZON_SSE_MAX_DURATION` | `3600` | Max SSE stream lifetime, seconds. | | `HORIZON_RATE_LIMIT_RPS` | `20` | Per-session limit, counted per JSON-RPC message per second; `0` disables. | | `HORIZON_INIT_RATE_LIMIT` | `5` | Pre-session `initialize` attempts per second (global cap and per remote address); `0` disables. | +| `HORIZON_IP_RATE_LIMIT` | `600` | Coarse per-IP request cap per second, a defense-in-depth backstop in front of the per-session limits; `0` disables. | Inbound mTLS settings (only when `HORIZON_HTTP_AUTH_MODE=mtls`): diff --git a/bun.lock b/bun.lock index 7eb69f6..b5b176d 100644 --- a/bun.lock +++ b/bun.lock @@ -7,6 +7,7 @@ "dependencies": { "@modelcontextprotocol/sdk": "1.29.0", "express": "^5", + "express-rate-limit": "8.5.2", "undici": "8.0.1", "zod": "4.3.6", }, @@ -596,7 +597,7 @@ "express": ["express@5.2.1", "", { "dependencies": { "accepts": "^2.0.0", "body-parser": "^2.2.1", "content-disposition": "^1.0.0", "content-type": "^1.0.5", "cookie": "^0.7.1", "cookie-signature": "^1.2.1", "debug": "^4.4.0", "depd": "^2.0.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "finalhandler": "^2.1.0", "fresh": "^2.0.0", "http-errors": "^2.0.0", "merge-descriptors": "^2.0.0", "mime-types": "^3.0.0", "on-finished": "^2.4.1", "once": "^1.4.0", "parseurl": "^1.3.3", "proxy-addr": "^2.0.7", "qs": "^6.14.0", "range-parser": "^1.2.1", "router": "^2.2.0", "send": "^1.1.0", "serve-static": "^2.2.0", "statuses": "^2.0.1", "type-is": "^2.0.1", "vary": "^1.1.2" } }, "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw=="], - "express-rate-limit": ["express-rate-limit@8.3.2", "", { "dependencies": { "ip-address": "10.1.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-77VmFeJkO0/rvimEDuUC5H30oqUC4EyOhyGccfqoLebB0oiEYfM7nwPrsDsBL1gsTpwfzX8SFy2MT3TDyRq+bg=="], + "express-rate-limit": ["express-rate-limit@8.5.2", "", { "dependencies": { "ip-address": "^10.2.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A=="], "fast-content-type-parse": ["fast-content-type-parse@3.0.0", "", {}, "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg=="], @@ -720,7 +721,7 @@ "into-stream": ["into-stream@7.0.0", "", { "dependencies": { "from2": "^2.3.0", "p-is-promise": "^3.0.0" } }, "sha512-2dYz766i9HprMBasCMvHMuazJ7u4WzhJwo5kb3iPSiW/iRYV6uPari3zHoqZlnuaR7V1bEiNMxikhp37rdBXbw=="], - "ip-address": ["ip-address@10.1.0", "", {}, "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q=="], + "ip-address": ["ip-address@10.2.0", "", {}, "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA=="], "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="], @@ -1232,6 +1233,8 @@ "@modelcontextprotocol/sdk/ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="], + "@modelcontextprotocol/sdk/express-rate-limit": ["express-rate-limit@8.3.2", "", { "dependencies": { "ip-address": "10.1.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-77VmFeJkO0/rvimEDuUC5H30oqUC4EyOhyGccfqoLebB0oiEYfM7nwPrsDsBL1gsTpwfzX8SFy2MT3TDyRq+bg=="], + "@modelcontextprotocol/sdk/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="], "@pnpm/network.ca-file/graceful-fs": ["graceful-fs@4.2.10", "", {}, "sha512-9ByhssR2fPVsNZj478qUUbKfmL0+t5BDVyjShtyZZLiK7ZDAArFFfopyOTj0M05wE2tJPisA4iTnnXl2YoPvOA=="], @@ -1618,6 +1621,8 @@ "@modelcontextprotocol/sdk/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="], + "@modelcontextprotocol/sdk/express-rate-limit/ip-address": ["ip-address@10.1.0", "", {}, "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q=="], + "@semantic-release/github/aggregate-error/clean-stack": ["clean-stack@5.3.0", "", { "dependencies": { "escape-string-regexp": "5.0.0" } }, "sha512-9ngPTOhYGQqNVSfeJkYXHmF7AGWp4/nN5D/QqNQs3Dvxd1Kk/WpjHfNujKHYUQ/5CoGyOyFNoWSPk5afzP0QVg=="], "@semantic-release/github/aggregate-error/indent-string": ["indent-string@5.0.0", "", {}, "sha512-m6FAo/spmsW2Ab2fU35JTYwtOKa2yAwXSwgjSv1TJzh4Mh7mC3lzAOVLBprb72XsTrgkEIsl7YrFNAiDiRhIGg=="], diff --git a/package.json b/package.json index 29f6a9e..3a719c6 100644 --- a/package.json +++ b/package.json @@ -44,6 +44,7 @@ "dependencies": { "@modelcontextprotocol/sdk": "1.29.0", "express": "^5", + "express-rate-limit": "8.5.2", "undici": "8.0.1", "zod": "4.3.6" }, diff --git a/src/generated/docs/api-doc-pages.json b/src/generated/docs/api-doc-pages.json index 12fdada..b10febb 100644 --- a/src/generated/docs/api-doc-pages.json +++ b/src/generated/docs/api-doc-pages.json @@ -1,5 +1,5 @@ { - "generatedAt": "2026-06-17T17:03:09.009Z", + "generatedAt": "2026-07-01T08:11:06.995Z", "pageCount": 1502, "pages": [ { @@ -672,7 +672,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -747,7 +747,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -785,7 +785,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -823,7 +823,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -1930,7 +1930,7 @@ "Register a new datasource" ], "summary": "Register a new datasource Register a new datasource Body required application/json Datasource to register DNS Datasource LDAP Datasource REST Datasource type string required Type of datasource Value dns name string required Name of the data", - "content": "Register a new datasource\n\n Register a new datasource\n\n Body\n required\n\napplication/json\n\n Datasource to register\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n notFoundHttpCodes\n\n array of integer\n\n HTTP response codes that indicate a \"not found\" result. Must not overlap with expectedHttpCodes . When received, the datasource will return a not_found status with no results. Combined with the mandatory parameter on a datasource flow entry, this can be used to stop a flow when a required resource is not found.\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n Responses\n\n 200\n Datasource successfully registered\n\napplication/json\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n notFoundHttpCodes\n\n array of integer\n\n HTTP response codes that indicate a \"not found\" result. Must not overlap with expectedHttpCodes . When received, the datasource will return a not_found status with no results. Combined with the mandatory parameter on a datasource flow entry, this can be used to stop a flow when a required resource is not found.\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n DS-002\n DS-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid DataSource\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid DataSource\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DataSource already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DataSource already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/datasources\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"notFoundHttpCodes\":\n\n +\n\n [\n\n 404\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"notFoundHttpCodes\":\n\n +\n\n [\n\n 404\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-002\"\n ,\n\n \"message\":\n \"Invalid DataSource\"\n ,\n\n \"title\":\n \"Invalid DataSource\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-004\"\n ,\n\n \"message\":\n \"DataSource already exists\"\n ,\n\n \"title\":\n \"DataSource already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-002\n DS-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DS-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n List the existing datasource(s)\n Update an existing datasource", + "content": "Register a new datasource\n\n Register a new datasource\n\n Body\n required\n\napplication/json\n\n Datasource to register\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n notFoundHttpCodes\n\n array of integer\n\n HTTP response codes that indicate a \"not found\" result. Must not overlap with expectedHttpCodes . When received, the datasource will return a not_found status with no results. Combined with the mandatory parameter on a datasource flow entry, this can be used to stop a flow when a required resource is not found.\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n Responses\n\n 201\n Datasource successfully registered\n\napplication/json\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n notFoundHttpCodes\n\n array of integer\n\n HTTP response codes that indicate a \"not found\" result. Must not overlap with expectedHttpCodes . When received, the datasource will return a not_found status with no results. Combined with the mandatory parameter on a datasource flow entry, this can be used to stop a flow when a required resource is not found.\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n DS-002\n DS-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid DataSource\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid DataSource\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DataSource already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DataSource already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/datasources\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"notFoundHttpCodes\":\n\n +\n\n [\n\n 404\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"notFoundHttpCodes\":\n\n +\n\n [\n\n 404\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-002\"\n ,\n\n \"message\":\n \"Invalid DataSource\"\n ,\n\n \"title\":\n \"Invalid DataSource\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-004\"\n ,\n\n \"message\":\n \"DataSource already exists\"\n ,\n\n \"title\":\n \"DataSource already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-002\n DS-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DS-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n List the existing datasource(s)\n Update an existing datasource", "keywords": [ "register", "new", @@ -2259,7 +2259,7 @@ "List DCV lifecycle events for a policy" ], "summary": "List DCV lifecycle events for a policy Retrieve DCV lifecycle events for a given policy with pagination Path parameters policy string required Name of the DCV policy Body required application/json sortedBy array of objects | null (SortEleme", - "content": "List DCV lifecycle events for a policy\n\n Retrieve DCV lifecycle events for a given policy with pagination\n\n Path parameters\n\n policy\n\n string\n required\n\n Name of the DCV policy\n\n Body\n required\n\napplication/json\n\n sortedBy\n\n array of objects | null (SortElement)\n +\n\n Array [\n\n element\n\n string\n required\n\n The name of the field the query should be sorted by. Must be one of the fields of the search query\n\n order\n\n string\n required\n\n The order to use for the sort. Asc and Desc sort the values, and KeyAsc and KeyDesc sort by the key, in case of a key-value element\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n ]\n\n pageIndex\n\n integer | null\n\n pageSize\n\n integer | null\n\n withCount\n\n boolean | null\n\n Responses\n\n 200\n Paginated list of DCV lifecycle events for the policy\n\napplication/json\n\n results\n\n array of objects (DCVLifecycleEvent)\n required +\n\n Array [\n\n status\n\n string\n required\n\n Enum\n started\n success\n failure\n retrying\n blocked\n\n timestamp\n\n string\n required\n\n Timestamp linked to the validation\n\n domain\n\n string\n required\n\n The domain\n\n policy\n\n string\n required\n\n The DCV policy name\n\n removeAt\n\n string\n required\n\n Timestamp when the event will be removed\n\n attempt\n\n integer\n\n Current retry attempt count\n\n lastError\n\n string | null\n\n Error message from the previous attempt\n\n msg\n\n string\n\n Error message describing the failure cause\n\n ]\n\n pageIndex\n\n integer\n required\n\n pageSize\n\n integer\n required\n\n hasMore\n\n boolean\n required\n\n count\n\n integer | null\n\n 204\n No events found for this policy\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-006\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n DCV policy not found\n\napplication/problem+json\n\n DCV-LIFECYCLE-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DCV Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DCV Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DCV-LIFECYCLE-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/dcv/lifecycle/events/{policy}\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"sortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"withCount\":\n true\n\n }\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"results\":\n\n +\n\n [\n\n +\n\n {\n\n \"status\":\n \"started\"\n ,\n\n \"timestamp\":\n \"2026-06-17T16:05:46.215Z\"\n ,\n\n \"domain\":\n \"string\"\n ,\n\n \"policy\":\n \"string\"\n ,\n\n \"removeAt\":\n \"2026-06-17T16:05:46.215Z\"\n ,\n\n \"attempt\":\n 0\n ,\n\n \"lastError\":\n \"string\"\n ,\n\n \"msg\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"count\":\n 0\n ,\n\n \"hasMore\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-002\"\n ,\n\n \"message\":\n \"DCV Policy not found\"\n ,\n\n \"title\":\n \"DCV Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Cancel an active DCV policy run\n List DCV lifecycle events for a specific domain", + "content": "List DCV lifecycle events for a policy\n\n Retrieve DCV lifecycle events for a given policy with pagination\n\n Path parameters\n\n policy\n\n string\n required\n\n Name of the DCV policy\n\n Body\n required\n\napplication/json\n\n sortedBy\n\n array of objects | null (SortElement)\n +\n\n Array [\n\n element\n\n string\n required\n\n The name of the field the query should be sorted by. Must be one of the fields of the search query\n\n order\n\n string\n required\n\n The order to use for the sort. Asc and Desc sort the values, and KeyAsc and KeyDesc sort by the key, in case of a key-value element\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n ]\n\n pageIndex\n\n integer | null\n\n pageSize\n\n integer | null\n\n withCount\n\n boolean | null\n\n Responses\n\n 200\n Paginated list of DCV lifecycle events for the policy\n\napplication/json\n\n results\n\n array of objects (DCVLifecycleEvent)\n required +\n\n Array [\n\n status\n\n string\n required\n\n Enum\n started\n success\n failure\n retrying\n blocked\n\n timestamp\n\n string\n required\n\n Timestamp linked to the validation\n\n domain\n\n string\n required\n\n The domain\n\n policy\n\n string\n required\n\n The DCV policy name\n\n removeAt\n\n string\n required\n\n Timestamp when the event will be removed\n\n attempt\n\n integer\n\n Current retry attempt count\n\n lastError\n\n string | null\n\n Error message from the previous attempt\n\n msg\n\n string\n\n Error message describing the failure cause\n\n ]\n\n pageIndex\n\n integer\n required\n\n pageSize\n\n integer\n required\n\n hasMore\n\n boolean\n required\n\n count\n\n integer | null\n\n 204\n No events found for this policy\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-006\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n DCV policy not found\n\napplication/problem+json\n\n DCV-LIFECYCLE-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DCV Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DCV Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DCV-LIFECYCLE-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/dcv/lifecycle/events/{policy}\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"sortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"withCount\":\n true\n\n }\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"results\":\n\n +\n\n [\n\n +\n\n {\n\n \"status\":\n \"started\"\n ,\n\n \"timestamp\":\n \"2026-06-26T08:41:07.310Z\"\n ,\n\n \"domain\":\n \"string\"\n ,\n\n \"policy\":\n \"string\"\n ,\n\n \"removeAt\":\n \"2026-06-26T08:41:07.310Z\"\n ,\n\n \"attempt\":\n 0\n ,\n\n \"lastError\":\n \"string\"\n ,\n\n \"msg\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"count\":\n 0\n ,\n\n \"hasMore\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-002\"\n ,\n\n \"message\":\n \"DCV Policy not found\"\n ,\n\n \"title\":\n \"DCV Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Cancel an active DCV policy run\n List DCV lifecycle events for a specific domain", "keywords": [ "list", "dcv", @@ -2297,7 +2297,7 @@ "List DCV lifecycle events for a specific domain" ], "summary": "List DCV lifecycle events for a specific domain Retrieve DCV lifecycle events for a specific domain under a given policy with pagination Path parameters policy string required Name of the DCV policy domain string required The domain hostnam", - "content": "List DCV lifecycle events for a specific domain\n\n Retrieve DCV lifecycle events for a specific domain under a given policy with pagination\n\n Path parameters\n\n policy\n\n string\n required\n\n Name of the DCV policy\n\n domain\n\n string\n required\n\n The domain hostname to retrieve events for\n\n Body\n required\n\napplication/json\n\n sortedBy\n\n array of objects | null (SortElement)\n +\n\n Array [\n\n element\n\n string\n required\n\n The name of the field the query should be sorted by. Must be one of the fields of the search query\n\n order\n\n string\n required\n\n The order to use for the sort. Asc and Desc sort the values, and KeyAsc and KeyDesc sort by the key, in case of a key-value element\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n ]\n\n pageIndex\n\n integer | null\n\n pageSize\n\n integer | null\n\n withCount\n\n boolean | null\n\n Responses\n\n 200\n Paginated list of DCV lifecycle events for the domain\n\napplication/json\n\n results\n\n array of objects (DCVLifecycleEvent)\n required +\n\n Array [\n\n status\n\n string\n required\n\n Enum\n started\n success\n failure\n retrying\n blocked\n\n timestamp\n\n string\n required\n\n Timestamp linked to the validation\n\n domain\n\n string\n required\n\n The domain\n\n policy\n\n string\n required\n\n The DCV policy name\n\n removeAt\n\n string\n required\n\n Timestamp when the event will be removed\n\n attempt\n\n integer\n\n Current retry attempt count\n\n lastError\n\n string | null\n\n Error message from the previous attempt\n\n msg\n\n string\n\n Error message describing the failure cause\n\n ]\n\n pageIndex\n\n integer\n required\n\n pageSize\n\n integer\n required\n\n hasMore\n\n boolean\n required\n\n count\n\n integer | null\n\n 204\n No events found for this domain\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-006\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n DCV policy not found\n\napplication/problem+json\n\n DCV-LIFECYCLE-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DCV Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DCV Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DCV-LIFECYCLE-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/dcv/lifecycle/events/{policy}/{domain}\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"sortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"withCount\":\n true\n\n }\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"results\":\n\n +\n\n [\n\n +\n\n {\n\n \"status\":\n \"started\"\n ,\n\n \"timestamp\":\n \"2026-06-17T16:05:46.215Z\"\n ,\n\n \"domain\":\n \"string\"\n ,\n\n \"policy\":\n \"string\"\n ,\n\n \"removeAt\":\n \"2026-06-17T16:05:46.215Z\"\n ,\n\n \"attempt\":\n 0\n ,\n\n \"lastError\":\n \"string\"\n ,\n\n \"msg\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"count\":\n 0\n ,\n\n \"hasMore\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-002\"\n ,\n\n \"message\":\n \"DCV Policy not found\"\n ,\n\n \"title\":\n \"DCV Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n List DCV lifecycle events for a policy\n DCV Providers", + "content": "List DCV lifecycle events for a specific domain\n\n Retrieve DCV lifecycle events for a specific domain under a given policy with pagination\n\n Path parameters\n\n policy\n\n string\n required\n\n Name of the DCV policy\n\n domain\n\n string\n required\n\n The domain hostname to retrieve events for\n\n Body\n required\n\napplication/json\n\n sortedBy\n\n array of objects | null (SortElement)\n +\n\n Array [\n\n element\n\n string\n required\n\n The name of the field the query should be sorted by. Must be one of the fields of the search query\n\n order\n\n string\n required\n\n The order to use for the sort. Asc and Desc sort the values, and KeyAsc and KeyDesc sort by the key, in case of a key-value element\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n ]\n\n pageIndex\n\n integer | null\n\n pageSize\n\n integer | null\n\n withCount\n\n boolean | null\n\n Responses\n\n 200\n Paginated list of DCV lifecycle events for the domain\n\napplication/json\n\n results\n\n array of objects (DCVLifecycleEvent)\n required +\n\n Array [\n\n status\n\n string\n required\n\n Enum\n started\n success\n failure\n retrying\n blocked\n\n timestamp\n\n string\n required\n\n Timestamp linked to the validation\n\n domain\n\n string\n required\n\n The domain\n\n policy\n\n string\n required\n\n The DCV policy name\n\n removeAt\n\n string\n required\n\n Timestamp when the event will be removed\n\n attempt\n\n integer\n\n Current retry attempt count\n\n lastError\n\n string | null\n\n Error message from the previous attempt\n\n msg\n\n string\n\n Error message describing the failure cause\n\n ]\n\n pageIndex\n\n integer\n required\n\n pageSize\n\n integer\n required\n\n hasMore\n\n boolean\n required\n\n count\n\n integer | null\n\n 204\n No events found for this domain\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-006\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n DCV policy not found\n\napplication/problem+json\n\n DCV-LIFECYCLE-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DCV Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DCV Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DCV-LIFECYCLE-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/dcv/lifecycle/events/{policy}/{domain}\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"sortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"withCount\":\n true\n\n }\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"results\":\n\n +\n\n [\n\n +\n\n {\n\n \"status\":\n \"started\"\n ,\n\n \"timestamp\":\n \"2026-06-26T08:41:07.310Z\"\n ,\n\n \"domain\":\n \"string\"\n ,\n\n \"policy\":\n \"string\"\n ,\n\n \"removeAt\":\n \"2026-06-26T08:41:07.310Z\"\n ,\n\n \"attempt\":\n 0\n ,\n\n \"lastError\":\n \"string\"\n ,\n\n \"msg\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"count\":\n 0\n ,\n\n \"hasMore\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-002\"\n ,\n\n \"message\":\n \"DCV Policy not found\"\n ,\n\n \"title\":\n \"DCV Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n List DCV lifecycle events for a policy\n DCV Providers", "keywords": [ "list", "dcv", @@ -5243,7 +5243,7 @@ "Export configuration items" ], "summary": "Export configuration items Export configuration items Body required application/json Items to export cas array of object | null (HorizonExportableItemsSeq) + Array [ name string required displayName array of objects | null (LocalizedString)", - "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n storages\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n identifierMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal identifier when a certificate from this CA is used for client authentication\n\n nameMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal name when a certificate from this CA is used for client authentication\n\n emailMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal email when a certificate from this CA is used for client authentication\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template.\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n storages\n\n array of objects (S3 Storage)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name for this storage\n\n type\n\n string\n required\n\n Type of storage\n\n Value\n s3\n\n timeout\n\n string | null (FiniteDuration)\n required\n\n Timeout while connecting to the S3\n\n forcePathStyle\n\n boolean\n required\n\n If enabled, force S3 path style requests\n\n bucket\n\n string\n required\n\n Name of the bucket to store items into\n\n partBufferSize\n\n string\n required\n\n credentials\n\n string\n\n Name of the password credentials containing AWS Secret Keys. If not defined, environment variables will be used\n\n roleArn\n\n string\n\n AWS Role ARN to impersonate\n\n region\n\n string\n\n AWS Region for the S3 storage. If not defined, environment variables will be used\n\n description\n\n string\n\n Simple description for this storage\n\n proxy\n\n string\n\n Reference to the proxy to use for connection to the S3\n\n endpoint\n\n string\n\n Custom endpoint to use for S3\n\n checksumMode\n\n string\n\n S3 Checksum mode\n\n Enum\n when_supported\n when_required\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n ,\n\n \"identifierMapping\":\n \"{{certificate.dn}}\"\n ,\n\n \"nameMapping\":\n \"{{certificate.subject.cn.1}}\"\n ,\n\n \"emailMapping\":\n \"{{certificate.san.rfc822name.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n ,\n\n \"mandatory\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"s3\"\n ,\n\n \"credentials\":\n \"aws-credentials\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"endpoint\":\n \"string\"\n ,\n\n \"forcePathStyle\":\n false\n ,\n\n \"bucket\":\n \"string\"\n ,\n\n \"checksumMode\":\n \"when_required\"\n ,\n\n \"partBufferSize\":\n \"9MB\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", + "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n storages\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n identifierMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal identifier when a certificate from this CA is used for client authentication\n\n nameMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal name when a certificate from this CA is used for client authentication\n\n emailMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal email when a certificate from this CA is used for client authentication\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template.\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n storages\n\n array of objects (S3 Storage)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name for this storage\n\n type\n\n string\n required\n\n Type of storage\n\n Value\n s3\n\n timeout\n\n string | null (FiniteDuration)\n required\n\n Timeout while connecting to the S3\n\n forcePathStyle\n\n boolean\n required\n\n If enabled, force S3 path style requests\n\n bucket\n\n string\n required\n\n Name of the bucket to store items into\n\n partBufferSize\n\n string\n required\n\n credentials\n\n string\n\n Name of the password credentials containing AWS Secret Keys. If not defined, environment variables will be used\n\n roleArn\n\n string\n\n AWS Role ARN to impersonate\n\n region\n\n string\n\n AWS Region for the S3 storage. If not defined, environment variables will be used\n\n description\n\n string\n\n Simple description for this storage\n\n proxy\n\n string\n\n Reference to the proxy to use for connection to the S3\n\n endpoint\n\n string\n\n Custom endpoint to use for S3\n\n checksumMode\n\n string\n\n S3 Checksum mode\n\n Enum\n when_supported\n when_required\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n ,\n\n \"identifierMapping\":\n \"{{certificate.dn}}\"\n ,\n\n \"nameMapping\":\n \"{{certificate.subject.cn.1}}\"\n ,\n\n \"emailMapping\":\n \"{{certificate.san.rfc822name.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n ,\n\n \"mandatory\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"s3\"\n ,\n\n \"credentials\":\n \"aws-credentials\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"endpoint\":\n \"string\"\n ,\n\n \"forcePathStyle\":\n false\n ,\n\n \"bucket\":\n \"string\"\n ,\n\n \"checksumMode\":\n \"when_required\"\n ,\n\n \"partBufferSize\":\n \"9MB\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", "keywords": [ "export", "configuration", @@ -5278,7 +5278,7 @@ "Import configuration items" ], "summary": "Import configuration items Import configuration items Body required application/json Items to import info object + createdAt string version string items object (Horizon Exportable Items) + cas array of objects (Certificate Authority) + Arra", - "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n identifierMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal identifier when a certificate from this CA is used for client authentication\n\n nameMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal name when a certificate from this CA is used for client authentication\n\n emailMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal email when a certificate from this CA is used for client authentication\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template.\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n storages\n\n array of objects (S3 Storage)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name for this storage\n\n type\n\n string\n required\n\n Type of storage\n\n Value\n s3\n\n timeout\n\n string | null (FiniteDuration)\n required\n\n Timeout while connecting to the S3\n\n forcePathStyle\n\n boolean\n required\n\n If enabled, force S3 path style requests\n\n bucket\n\n string\n required\n\n Name of the bucket to store items into\n\n partBufferSize\n\n string\n required\n\n credentials\n\n string\n\n Name of the password credentials containing AWS Secret Keys. If not defined, environment variables will be used\n\n roleArn\n\n string\n\n AWS Role ARN to impersonate\n\n region\n\n string\n\n AWS Region for the S3 storage. If not defined, environment variables will be used\n\n description\n\n string\n\n Simple description for this storage\n\n proxy\n\n string\n\n Reference to the proxy to use for connection to the S3\n\n endpoint\n\n string\n\n Custom endpoint to use for S3\n\n checksumMode\n\n string\n\n S3 Checksum mode\n\n Enum\n when_supported\n when_required\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n ,\n\n \"identifierMapping\":\n \"{{certificate.dn}}\"\n ,\n\n \"nameMapping\":\n \"{{certificate.subject.cn.1}}\"\n ,\n\n \"emailMapping\":\n \"{{certificate.san.rfc822name.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n ,\n\n \"mandatory\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"s3\"\n ,\n\n \"credentials\":\n \"aws-credentials\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"endpoint\":\n \"string\"\n ,\n\n \"forcePathStyle\":\n false\n ,\n\n \"bucket\":\n \"string\"\n ,\n\n \"checksumMode\":\n \"when_required\"\n ,\n\n \"partBufferSize\":\n \"9MB\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Storages", + "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n identifierMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal identifier when a certificate from this CA is used for client authentication\n\n nameMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal name when a certificate from this CA is used for client authentication\n\n emailMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal email when a certificate from this CA is used for client authentication\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template.\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n storages\n\n array of objects (S3 Storage)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name for this storage\n\n type\n\n string\n required\n\n Type of storage\n\n Value\n s3\n\n timeout\n\n string | null (FiniteDuration)\n required\n\n Timeout while connecting to the S3\n\n forcePathStyle\n\n boolean\n required\n\n If enabled, force S3 path style requests\n\n bucket\n\n string\n required\n\n Name of the bucket to store items into\n\n partBufferSize\n\n string\n required\n\n credentials\n\n string\n\n Name of the password credentials containing AWS Secret Keys. If not defined, environment variables will be used\n\n roleArn\n\n string\n\n AWS Role ARN to impersonate\n\n region\n\n string\n\n AWS Region for the S3 storage. If not defined, environment variables will be used\n\n description\n\n string\n\n Simple description for this storage\n\n proxy\n\n string\n\n Reference to the proxy to use for connection to the S3\n\n endpoint\n\n string\n\n Custom endpoint to use for S3\n\n checksumMode\n\n string\n\n S3 Checksum mode\n\n Enum\n when_supported\n when_required\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n ,\n\n \"identifierMapping\":\n \"{{certificate.dn}}\"\n ,\n\n \"nameMapping\":\n \"{{certificate.subject.cn.1}}\"\n ,\n\n \"emailMapping\":\n \"{{certificate.san.rfc822name.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n ,\n\n \"mandatory\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"s3\"\n ,\n\n \"credentials\":\n \"aws-credentials\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"endpoint\":\n \"string\"\n ,\n\n \"forcePathStyle\":\n false\n ,\n\n \"bucket\":\n \"string\"\n ,\n\n \"checksumMode\":\n \"when_required\"\n ,\n\n \"partBufferSize\":\n \"9MB\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Storages", "keywords": [ "import", "configuration", @@ -8581,7 +8581,7 @@ "Create a new principal" ], "summary": "Create a new principal Create a new principal in Horizon Body required application/json The principal's information to register identifier string required The identifier of the principal enabled boolean required If the principal is allowed ", - "content": "Create a new principal\n\n Create a new principal in Horizon\n\n Body\n required\n\napplication/json\n\n The principal's information to register\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n Responses\n\n 200\n Principal information successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n creationDate\n\n integer\n\n The creation date of the principal (UNIX Timestamp in milliseconds)\n\n lastAuthentication\n\n integer | null\n\n The last authentication date of the principal (UNIX Timestamp in milliseconds)\n\n lastModification\n\n integer | null\n\n The last modification date of the principal (UNIX Timestamp in milliseconds)\n\n 400\n Unable to register the principal\n\napplication/problem+json\n\n SEC-PI-002\n SEC-PI-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Principal Info\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Principal Info\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal info already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal info already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Authentication error\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Unexpected internal server error\n\napplication/problem+json\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/security/principalinfos\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enabled\":\n true\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"creationDate\":\n 1601900000000\n ,\n\n \"lastAuthentication\":\n 1601900000000\n ,\n\n \"lastModification\":\n 1601900000000\n ,\n\n \"enabled\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-002\"\n ,\n\n \"message\":\n \"Invalid Principal Info\"\n ,\n\n \"title\":\n \"Invalid Principal Info\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-004\"\n ,\n\n \"message\":\n \"Principal info already exists\"\n ,\n\n \"title\":\n \"Principal info already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-002\n SEC-PI-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-PI-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n Principal Information\n Update a principal's information", + "content": "Create a new principal\n\n Create a new principal in Horizon\n\n Body\n required\n\napplication/json\n\n The principal's information to register\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n Responses\n\n 201\n Principal information successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n creationDate\n\n integer\n\n The creation date of the principal (UNIX Timestamp in milliseconds)\n\n lastAuthentication\n\n integer | null\n\n The last authentication date of the principal (UNIX Timestamp in milliseconds)\n\n lastModification\n\n integer | null\n\n The last modification date of the principal (UNIX Timestamp in milliseconds)\n\n 400\n Unable to register the principal\n\napplication/problem+json\n\n SEC-PI-002\n SEC-PI-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Principal Info\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Principal Info\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal info already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal info already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Authentication error\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Unexpected internal server error\n\napplication/problem+json\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/security/principalinfos\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enabled\":\n true\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"creationDate\":\n 1601900000000\n ,\n\n \"lastAuthentication\":\n 1601900000000\n ,\n\n \"lastModification\":\n 1601900000000\n ,\n\n \"enabled\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-002\"\n ,\n\n \"message\":\n \"Invalid Principal Info\"\n ,\n\n \"title\":\n \"Invalid Principal Info\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-004\"\n ,\n\n \"message\":\n \"Principal info already exists\"\n ,\n\n \"title\":\n \"Principal info already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-002\n SEC-PI-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-PI-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n Principal Information\n Update a principal's information", "keywords": [ "create", "new", @@ -25976,7 +25976,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -26051,7 +26051,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -26089,7 +26089,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -26127,7 +26127,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -34595,7 +34595,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -34670,7 +34670,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -34708,7 +34708,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -34746,7 +34746,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -35853,7 +35853,7 @@ "Register a new datasource" ], "summary": "Register a new datasource Register a new datasource Body required application/json Datasource to register DNS Datasource LDAP Datasource REST Datasource type string required Type of datasource Value dns name string required Name of the data", - "content": "Register a new datasource\n\n Register a new datasource\n\n Body\n required\n\napplication/json\n\n Datasource to register\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n Responses\n\n 200\n Datasource successfully registered\n\napplication/json\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n DS-002\n DS-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid DataSource\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid DataSource\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DataSource already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DataSource already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/datasources\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-002\"\n ,\n\n \"message\":\n \"Invalid DataSource\"\n ,\n\n \"title\":\n \"Invalid DataSource\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-004\"\n ,\n\n \"message\":\n \"DataSource already exists\"\n ,\n\n \"title\":\n \"DataSource already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-002\n DS-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DS-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n List the existing datasource(s)\n Update an existing datasource", + "content": "Register a new datasource\n\n Register a new datasource\n\n Body\n required\n\napplication/json\n\n Datasource to register\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n Responses\n\n 201\n Datasource successfully registered\n\napplication/json\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n DS-002\n DS-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid DataSource\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid DataSource\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DataSource already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DataSource already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/datasources\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-002\"\n ,\n\n \"message\":\n \"Invalid DataSource\"\n ,\n\n \"title\":\n \"Invalid DataSource\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-004\"\n ,\n\n \"message\":\n \"DataSource already exists\"\n ,\n\n \"title\":\n \"DataSource already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-002\n DS-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DS-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n List the existing datasource(s)\n Update an existing datasource", "keywords": [ "register", "new", @@ -38093,7 +38093,7 @@ "Export configuration items" ], "summary": "Export configuration items Export configuration items Body required application/json Items to export cas array of object | null (HorizonExportableItemsSeq) + Array [ name string required displayName array of objects | null (LocalizedString)", - "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", + "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", "keywords": [ "export", "configuration", @@ -38128,7 +38128,7 @@ "Import configuration items" ], "summary": "Import configuration items Import configuration items Body required application/json Items to import info object + createdAt string version string items object (Horizon Exportable Items) + cas array of objects (Certificate Authority) + Arra", - "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", + "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", "keywords": [ "import", "configuration", @@ -41466,7 +41466,7 @@ "Create a new principal" ], "summary": "Create a new principal Create a new principal in Horizon Body required application/json The principal's information to register identifier string required The identifier of the principal enabled boolean required If the principal is allowed ", - "content": "Create a new principal\n\n Create a new principal in Horizon\n\n Body\n required\n\napplication/json\n\n The principal's information to register\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n Responses\n\n 200\n Principal information successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n creationDate\n\n integer\n required\n\n The creation date of the principal (UNIX Timestamp in milliseconds)\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n lastAuthentication\n\n integer | null\n\n The last authentication date of the principal (UNIX Timestamp in milliseconds)\n\n lastModification\n\n integer | null\n\n The last modification date of the principal (UNIX Timestamp in milliseconds)\n\n 400\n Unable to register the principal\n\napplication/problem+json\n\n SEC-PI-002\n SEC-PI-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Principal Info\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Principal Info\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal info already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal info already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Authentication error\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Unexpected internal server error\n\napplication/problem+json\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/security/principalinfos\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enabled\":\n true\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"creationDate\":\n 1601900000000\n ,\n\n \"lastAuthentication\":\n 1601900000000\n ,\n\n \"lastModification\":\n 1601900000000\n ,\n\n \"enabled\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-002\"\n ,\n\n \"message\":\n \"Invalid Principal Info\"\n ,\n\n \"title\":\n \"Invalid Principal Info\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-004\"\n ,\n\n \"message\":\n \"Principal info already exists\"\n ,\n\n \"title\":\n \"Principal info already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-002\n SEC-PI-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-PI-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n Principal Information\n Update a principal's information", + "content": "Create a new principal\n\n Create a new principal in Horizon\n\n Body\n required\n\napplication/json\n\n The principal's information to register\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n Responses\n\n 201\n Principal information successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n creationDate\n\n integer\n required\n\n The creation date of the principal (UNIX Timestamp in milliseconds)\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n lastAuthentication\n\n integer | null\n\n The last authentication date of the principal (UNIX Timestamp in milliseconds)\n\n lastModification\n\n integer | null\n\n The last modification date of the principal (UNIX Timestamp in milliseconds)\n\n 400\n Unable to register the principal\n\napplication/problem+json\n\n SEC-PI-002\n SEC-PI-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Principal Info\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Principal Info\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal info already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal info already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Authentication error\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Unexpected internal server error\n\napplication/problem+json\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/security/principalinfos\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enabled\":\n true\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"creationDate\":\n 1601900000000\n ,\n\n \"lastAuthentication\":\n 1601900000000\n ,\n\n \"lastModification\":\n 1601900000000\n ,\n\n \"enabled\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-002\"\n ,\n\n \"message\":\n \"Invalid Principal Info\"\n ,\n\n \"title\":\n \"Invalid Principal Info\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-004\"\n ,\n\n \"message\":\n \"Principal info already exists\"\n ,\n\n \"title\":\n \"Principal info already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-002\n SEC-PI-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-PI-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n Principal Information\n Update a principal's information", "keywords": [ "create", "new", @@ -44068,7 +44068,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -44143,7 +44143,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -44181,7 +44181,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -44219,7 +44219,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -45326,7 +45326,7 @@ "Register a new datasource" ], "summary": "Register a new datasource Register a new datasource Body required application/json Datasource to register DNS Datasource LDAP Datasource REST Datasource type string required Type of datasource Value dns name string required Name of the data", - "content": "Register a new datasource\n\n Register a new datasource\n\n Body\n required\n\napplication/json\n\n Datasource to register\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n Responses\n\n 200\n Datasource successfully registered\n\napplication/json\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n DS-002\n DS-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid DataSource\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid DataSource\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DataSource already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DataSource already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/datasources\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-002\"\n ,\n\n \"message\":\n \"Invalid DataSource\"\n ,\n\n \"title\":\n \"Invalid DataSource\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-004\"\n ,\n\n \"message\":\n \"DataSource already exists\"\n ,\n\n \"title\":\n \"DataSource already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-002\n DS-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DS-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n List the existing datasource(s)\n Update an existing datasource", + "content": "Register a new datasource\n\n Register a new datasource\n\n Body\n required\n\napplication/json\n\n Datasource to register\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n Responses\n\n 201\n Datasource successfully registered\n\napplication/json\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n dns\n\n name\n\n string\n required\n\n Name of the datasource\n\n lookup\n\n string (TemplateString)\n required\n\n Host to lookup\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n host\n\n string | null\n\n Ip of the DNS server. If empty, Horizon Server DNS is used\n\n port\n\n integer | null\n\n Port on which to join the DNS server\n\n timeout\n\n string | null\n\n Timeout for the DNS request\n\n recordTypes\n\n array of string | null\n\n Type of DNS records to fetch. All available record types are fetched if null\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n ldap\n\n name\n\n string\n required\n\n Name of the datasource\n\n credentials\n\n string\n required\n\n Name of the password credentials to use for LDAP Authentication\n\n hostname\n\n string\n required\n\n Hostname of the LDAP server\n\n timeout\n\n string\n required\n\n Timeout for the LDAP request\n\n secure\n\n boolean\n required\n\n Use secure LDAP connection\n\n baseDn\n\n string (TemplateString)\n required\n\n LDAP Base DN\n\n filter\n\n string (TemplateString)\n required\n\n LDAP Filter\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n port\n\n integer | null\n\n Port on which to join the LDAP server\n\n proxy\n\n string | null\n\n Name of the proxy to use to reach the LDAP server\n\n disableHostnameValidation\n\n boolean | null\n\n Disable hostname validation for the LDAP connection\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n type\n\n string\n required\n\n Type of datasource\n\n Value\n rest\n\n name\n\n string\n required\n\n Name of the datasource\n\n method\n\n string\n required\n\n The HTTP method to use for the request\n\n url\n\n string (TemplateString)\n required\n\n The URL to request\n\n authenticationType\n\n string\n required\n\n The authentication type to use while making the REST call. Is linked to credentials .\n\n Enum\n noauth\n basic\n x509\n bearer\n custom\n\n expectedHttpCodes\n\n array of integer\n required\n\n The success HTTP codes for the request. If the return code is not in this list, the request will be considered failed.\n\n timeout\n\n string\n required\n\n Timeout for the HTTP request.\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized name of the datasource\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n string\n\n Description of the datasource\n\n credentials\n\n string\n\n Name of the credentials to use for authentication\n\n headers\n\n array of object | null (header)\n +\n\n The headers of the request\n\n Array [\n\n name\n\n string\n\n The header name\n\n value\n\n string (TemplateString)\n\n The header value\n\n ]\n\n payloadType\n\n string | null\n\n For UI purposes in order to format the body correctly\n\n payload\n\n string | null (TemplateString)\n\n The body of the request\n\n proxy\n\n string | null\n\n Name of a Proxy to use while making the request\n\n attributes\n\n array of objects | null (Datasource Output)\n +\n\n List of attributes to fetch for this datasource\n\n Array [\n\n key\n\n string\n required\n\n Key of the output\n\n multi\n\n boolean | null\n\n Determine if this attribute is multivalued\n\n selected\n\n boolean | null\n\n Determine if the attribute is selected on future fetches\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n DS-002\n DS-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid DataSource\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid DataSource\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DataSource already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DataSource already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DS-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/datasources\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"ldap\"\n ,\n\n \"name\":\n \"LDAP_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get LDAP values...\"\n ,\n\n \"credentials\":\n \"LDAP_Credentials\"\n ,\n\n \"hostname\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 3389\n ,\n\n \"proxy\":\n \"LDAP_Proxy\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"secure\":\n true\n ,\n\n \"disableHostnameValidation\":\n false\n ,\n\n \"baseDn\":\n \"dc=evertrust,dc=lab\"\n ,\n\n \"filter\":\n \"(cn={{cn}})\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"rest\"\n ,\n\n \"name\":\n \"REST_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get REST values...\"\n ,\n\n \"credentials\":\n \"REST_Credentials\"\n ,\n\n \"method\":\n \"GET\"\n ,\n\n \"url\":\n \"https://horizon.evertrust.fr/api/v1/test\"\n ,\n\n \"authenticationType\":\n \"bearer\"\n ,\n\n \"headers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Content-Type\"\n ,\n\n \"value\":\n \"application/json\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"payloadType\":\n \"json\"\n ,\n\n \"payload\":\n \"Hello {{certificate.dn.cn.1}}.\"\n ,\n\n \"expectedHttpCodes\":\n\n +\n\n [\n\n 200\n ,\n\n 204\n\n ...\n ]\n ,\n\n \"proxy\":\n \"ProxyForInternet\"\n ,\n\n \"timeout\":\n \"30 s\"\n ,\n\n \"attributes\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"cn\"\n ,\n\n \"multi\":\n false\n ,\n\n \"selected\":\n true\n\n ...\n }\n\n ...\n ]\n\n }\n\n DNS Datasource\n LDAP Datasource\n REST Datasource\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-002\"\n ,\n\n \"message\":\n \"Invalid DataSource\"\n ,\n\n \"title\":\n \"Invalid DataSource\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"DS-004\"\n ,\n\n \"message\":\n \"DataSource already exists\"\n ,\n\n \"title\":\n \"DataSource already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-002\n DS-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DS-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n DS-001\n SEC-AUTH-001\n LIC-001\n\n List the existing datasource(s)\n Update an existing datasource", "keywords": [ "register", "new", @@ -47591,7 +47591,7 @@ "Export configuration items" ], "summary": "Export configuration items Export configuration items Body required application/json Items to export cas array of object | null (HorizonExportableItemsSeq) + Array [ name string required displayName array of objects | null (LocalizedString)", - "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", + "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", "keywords": [ "export", "configuration", @@ -47626,7 +47626,7 @@ "Import configuration items" ], "summary": "Import configuration items Import configuration items Body required application/json Items to import info object + createdAt string version string items object (Horizon Exportable Items) + cas array of objects (Certificate Authority) + Arra", - "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-17\"\n ,\n\n \"end\":\n \"2026-06-17\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", + "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", "keywords": [ "import", "configuration", @@ -50929,7 +50929,7 @@ "Create a new principal" ], "summary": "Create a new principal Create a new principal in Horizon Body required application/json The principal's information to register identifier string required The identifier of the principal enabled boolean required If the principal is allowed ", - "content": "Create a new principal\n\n Create a new principal in Horizon\n\n Body\n required\n\napplication/json\n\n The principal's information to register\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n Responses\n\n 200\n Principal information successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n creationDate\n\n integer\n\n The creation date of the principal (UNIX Timestamp in milliseconds)\n\n lastAuthentication\n\n integer | null\n\n The last authentication date of the principal (UNIX Timestamp in milliseconds)\n\n lastModification\n\n integer | null\n\n The last modification date of the principal (UNIX Timestamp in milliseconds)\n\n 400\n Unable to register the principal\n\napplication/problem+json\n\n SEC-PI-002\n SEC-PI-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Principal Info\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Principal Info\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal info already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal info already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Authentication error\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Unexpected internal server error\n\napplication/problem+json\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/security/principalinfos\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enabled\":\n true\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"creationDate\":\n 1601900000000\n ,\n\n \"lastAuthentication\":\n 1601900000000\n ,\n\n \"lastModification\":\n 1601900000000\n ,\n\n \"enabled\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-002\"\n ,\n\n \"message\":\n \"Invalid Principal Info\"\n ,\n\n \"title\":\n \"Invalid Principal Info\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-004\"\n ,\n\n \"message\":\n \"Principal info already exists\"\n ,\n\n \"title\":\n \"Principal info already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-002\n SEC-PI-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-PI-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n Principal Information\n Update a principal's information", + "content": "Create a new principal\n\n Create a new principal in Horizon\n\n Body\n required\n\napplication/json\n\n The principal's information to register\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n Responses\n\n 201\n Principal information successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n identifier\n\n string\n required\n\n The identifier of the principal\n\n enabled\n\n boolean\n required\n\n If the principal is allowed to login horizon\n\n contact\n\n string | null\n\n The contact e-mail of the principal\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The permissions of the principal\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n roles\n\n array of string | null\n\n The roles of the principal\n\n teams\n\n array of string | null\n\n The teams of the principal\n\n savedQueries\n\n array of objects | null (Principal queries)\n +\n\n The saved HQL queries of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n type\n\n string\n required\n\n The type of the query\n\n Enum\n heql\n hcql\n hrql\n hpql\n hdql\n\n query\n\n string\n required\n\n The saved HQL query\n\n name\n\n string\n required\n\n Internal name of the saved request\n\n description\n\n string | null\n\n The saved request description\n\n ]\n\n customDashboards\n\n array of objects | null (Dashboard)\n +\n\n The custom dashboards of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n Array [\n\n name\n\n string\n required\n\n The dashboard's name\n\n charts\n\n array of objects (Chart)\n required +\n\n The dashboard's list of charts\n\n Array [\n\n title\n\n string\n required\n\n Title of the chart\n\n type\n\n string\n required\n\n The type of the chart\n\n Enum\n treemap\n bar-horizontal\n line\n pie\n heatmap\n bar-horizontal-stacked\n metric\n radar\n donut\n bar-vertical-stacked\n table\n area\n bar-vertical\n\n fields\n\n array of string\n required\n\n The field that will be used to group data\n\n colors\n\n array of string\n required\n\n The colors of the chart\n\n log\n\n boolean\n required\n\n Whether the logarithm scale is enabled or not\n\n description\n\n string | null\n\n The description of the chart\n\n limit\n\n integer | null\n\n The maximum number of results to display\n\n having\n\n object | null (Having)\n +\n\n A condition to apply to the results of the aggregate. Only the aggregates results with more than 5 items in them can be kept for example\n\n operator\n\n string\n required\n\n A mongoDB operator for comparison\n\n Enum\n gte\n lte\n gt\n eq\n ne\n lt\n\n value\n\n integer\n required\n\n An integer for the right hand side of the condition\n\n sortOrder\n\n string | null\n\n How to sort the results in the chart (if applicable)\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n localQuery\n\n string | null\n\n The HCQL/HRQL query to build the chart from\n\n direction\n\n string | null\n\n Enum\n asc\n desc\n\n i\n\n string | null\n\n The index of the chart on the dashboard\n\n x\n\n integer | null\n\n The horizontal position of the chart on the grid\n\n y\n\n integer | null\n\n The vertical position of the chart on the grid\n\n w\n\n integer | null\n\n The width of the chart\n\n h\n\n integer | null\n\n The height of the chart\n\n ]\n\n type\n\n string\n required\n\n The type of objects the dashboard displays\n\n Enum\n certificate\n request\n\n description\n\n string | null\n\n The dashboard's description\n\n ]\n\n preferences\n\n object | null (Principal Preferences)\n +\n\n The UI preferences of the principal. This is used by UI only. These values should not be manually set but should be copied on update\n\n darkMode\n\n boolean | null\n\n Dark Mode is enabled on UI for this user\n\n expertMode\n\n boolean\n\n Expert mode is enabled on UI for this user\n\n lang\n\n string | null\n\n The preferred language of the user\n\n Enum\n en\n fr\n\n certificateFields\n\n array of string | null\n\n The user's preferred columns on certificate view\n\n requestFields\n\n array of string | null\n\n The user's preferred columns on request view\n\n creationDate\n\n integer\n\n The creation date of the principal (UNIX Timestamp in milliseconds)\n\n lastAuthentication\n\n integer | null\n\n The last authentication date of the principal (UNIX Timestamp in milliseconds)\n\n lastModification\n\n integer | null\n\n The last modification date of the principal (UNIX Timestamp in milliseconds)\n\n 400\n Unable to register the principal\n\napplication/problem+json\n\n SEC-PI-002\n SEC-PI-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Principal Info\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Principal Info\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal info already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal info already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Authentication error\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Unexpected internal server error\n\napplication/problem+json\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PI-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/security/principalinfos\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enabled\":\n true\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"identifier\":\n \"administrator\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"SuperAdmin\"\n ,\n\n \"webRA_Approver\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"PKIOps\"\n ,\n\n \"CISO\"\n\n ...\n ]\n ,\n\n \"savedQueries\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"hcql\"\n ,\n\n \"query\":\n \"status is valid and valid.until before 7 days\"\n ,\n\n \"name\":\n \"Certificates7Days\"\n ,\n\n \"description\":\n \"Valid certificates that will expire within 7 days\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"customDashboards\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"My Certificate Dashboard\"\n ,\n\n \"description\":\n \"Here I can see my certificates\"\n ,\n\n \"charts\":\n\n +\n\n [\n\n +\n\n {\n\n \"title\":\n \"Certificate status on the WebRA\"\n ,\n\n \"description\":\n \"Certificates grouped by validity status (expired, revoked or valid) on the WebRA\"\n ,\n\n \"type\":\n \"donut\"\n ,\n\n \"fields\":\n\n +\n\n [\n\n \"status\"\n\n ...\n ]\n ,\n\n \"limit\":\n 100\n ,\n\n \"having\":\n\n +\n\n {\n\n \"operator\":\n \"gt\"\n ,\n\n \"value\":\n 5\n\n ...\n }\n ,\n\n \"sortOrder\":\n \"KeyAsc\"\n ,\n\n \"localQuery\":\n \"module in [\\\"webra\\\"]\"\n ,\n\n \"direction\":\n \"asc\"\n ,\n\n \"colors\":\n\n +\n\n [\n\n \"#54B399\"\n ,\n\n \"#6092C0\"\n\n ...\n ]\n ,\n\n \"i\":\n \"1\"\n ,\n\n \"x\":\n 1\n ,\n\n \"y\":\n 1\n ,\n\n \"w\":\n 2\n ,\n\n \"h\":\n 3\n ,\n\n \"log\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"type\":\n \"certificate\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"preferences\":\n\n +\n\n {\n\n \"darkMode\":\n false\n ,\n\n \"expertMode\":\n false\n ,\n\n \"lang\":\n \"en\"\n ,\n\n \"certificateFields\":\n\n +\n\n [\n\n \"profile\"\n ,\n\n \"module\"\n\n ...\n ]\n ,\n\n \"requestFields\":\n\n +\n\n [\n\n \"workflow\"\n ,\n\n \"module\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"creationDate\":\n 1601900000000\n ,\n\n \"lastAuthentication\":\n 1601900000000\n ,\n\n \"lastModification\":\n 1601900000000\n ,\n\n \"enabled\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-002\"\n ,\n\n \"message\":\n \"Invalid Principal Info\"\n ,\n\n \"title\":\n \"Invalid Principal Info\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"SEC-PI-004\"\n ,\n\n \"message\":\n \"Principal info already exists\"\n ,\n\n \"title\":\n \"Principal info already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-002\n SEC-PI-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-PI-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PI-001\n SEC-AUTH-001\n LIC-001\n\n Principal Information\n Update a principal's information", "keywords": [ "create", "new", diff --git a/src/generated/docs/companion-doc-pages.json b/src/generated/docs/companion-doc-pages.json index 68b4fd8..198c2c1 100644 --- a/src/generated/docs/companion-doc-pages.json +++ b/src/generated/docs/companion-doc-pages.json @@ -1,6 +1,6 @@ { - "generatedAt": "2026-06-17T17:03:09.009Z", - "pageCount": 227, + "generatedAt": "2026-07-01T08:11:06.995Z", + "pageCount": 160, "pages": [ { "page_id": "adcs-connector:1:install-guide:initial-config", @@ -587,22 +587,22 @@ "keywords": ["evertrust", "horizon", "overview", "index"] }, { - "page_id": "horizon-cli:1.10:automation.html", + "page_id": "horizon-cli:1.11:automation.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "Automation", "section": "automation.html", "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" ], "summary": "Automation The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly usef", - "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n tomcat (Linux & Windows)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n generic (Linux & Windows)\n\n windows (Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate enroll command:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n the --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n Routine\n\n Table 27. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 28. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 29. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 30. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 31. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 32. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.10.3 release notes", + "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n Routine\n\n Table 27. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 28. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 29. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 30. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 31. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 32. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.11.3 release notes", "keywords": [ "automation", "html", @@ -615,48 +615,48 @@ ] }, { - "page_id": "horizon-cli:1.10:basic.html", + "page_id": "horizon-cli:1.11:basic.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "Basic commands", "section": "basic.html", "slug": "basic.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", "keywords": ["basic", "commands", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.10:bulk.html", + "page_id": "horizon-cli:1.11:bulk.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "Bulk operations", "section": "bulk.html", "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", "keywords": ["bulk", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.10:config.html", + "page_id": "horizon-cli:1.11:config.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "General Configuration and Usage", "section": "config.html", "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", @@ -672,32 +672,32 @@ ] }, { - "page_id": "horizon-cli:1.10:discovery.html", + "page_id": "horizon-cli:1.11:discovery.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "Discovery Operations", "section": "discovery.html", "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", - "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n To specify a proxy dedicated to Qualys CV, you can use the flag --external-proxy with the proxy address and port as value.\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword --external-proxy=\"http://qualyscv.proxy:8888\"\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n To specify a proxy dedicated to Nessus, you can use the flag --external-proxy with the proxy address and port as value.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5 --external-proxy=\"http://nessus.proxy:8888\"\n\n Basic commands\n Import operations", + "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", "keywords": ["discovery", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.10:est.html", + "page_id": "horizon-cli:1.11:est.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "EST Certificate Lifecycle Operations", "section": "est.html", "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -712,59 +712,59 @@ ] }, { - "page_id": "horizon-cli:1.10:import.html", + "page_id": "horizon-cli:1.11:import.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "Import Operations", "section": "import.html", "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key> --external-proxy=<proxy address:port>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key> --external-proxy=<proxy address:port>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret> --external-proxy=<proxy address:port>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password> --external-proxy=<proxy address:port>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n GlobalSign\n\n You can import all your valid certificates from GlobalSign. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport globalsign --campaign=test --username=<AuthToken Username> --password=<AuthToken Password> --order-status=<OrderStatus> --external-proxy=<proxy address:port>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", + "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", "keywords": ["import", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.10:introduction.html", + "page_id": "horizon-cli:1.11:introduction.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "Introduction", "section": "introduction.html", "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.10 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", + "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.11 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", "keywords": ["introduction", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.10:release-notes:1.10.0", + "page_id": "horizon-cli:1.11:release-notes:1.11.0", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", - "title": "Horizon Cli 1.10.0 release notes", + "version": "1.11", + "title": "Horizon Cli 1.11.0 release notes", "section": "release-notes", - "slug": "release-notes/1.10.0", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/release-notes/1.10.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.10/release-notes/1.10.0.html", + "slug": "release-notes/1.11.0", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.0.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.0.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.10.0 release notes" + "Horizon Cli 1.11.0 release notes" ], - "summary": "Horizon Cli 1.10.0 release notes Here are the release notes for EverTrust Horizon Client v1.10.0, released on 2024-12-06. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. Configuration file for", - "content": "Horizon Cli 1.10.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.10.0, released on 2024-12-06.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\nConfiguration file format was changed to YAML and local configurations are now available. Learn more\n\n 1. New Features\n\n [HCL-401] - Added the windows target. Learn more\n\n [HCL-371] - Automation: added the --request-challenge option to automatically request a challenge\n\n [HCL-400] - Added ping command to debug configuration\n\n 2. Enhancements\n\n [HCL-370] - Windows store based targets will now only keep the current certificate in the store and remove outdated ones\n\n [HCL-402] - Added the --revoke option when removing a certificate from automation\n\n [HCL-398] - Improved configuration capabilities\n\n [HCL-409] - Localscan: add warning event when a path containing an environment variable is detected\n\n [HCL-408] - Localscan: improve keystore handling\n\n [HCL-390] - IIS: Local ACME provider can now be used\n\n [HCL-394] - Improved ACME options help menu\n\n [HCL-385] - Improved errors for WebRA enroll commands\n\n 3. Bug Fixes\n\n [HCL-396] - Fixed a bug where automate control was not possible when using ACME in some cases\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Horizon Cli 1.10.1 release notes", + "summary": "Horizon Cli 1.11.0 release notes Here are the release notes for EverTrust Horizon Client v1.11.0, released on 2025-04-11. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-4", + "content": "Horizon Cli 1.11.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.11.0, released on 2025-04-11.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-407] - Added the --select-certs flag to select webserver certificates without interaction. Learn more\n\n [HCL-404] - Added the haproxy target\n\n [HCL-449] - Certificate storage info is now available in post-enrollment script. Learn more\n\n [HCL-453] - Netimport: added support for Akamai CPS\n\n 2. Enhancements\n\n [HCL-454] - Netimport: credentials can now be given using environment variables\n\n [HCL-455] - Localscan: added --all-certs to retrieve all certs regardless of usage, and --all-paths to scan the whole filesystem\n\n [HCL-456] - Generic automation:\n\n automate control can now control generic certificates outside of the standard folder\n\n windows store entry storage now removes excess certificates when not using --no-install\n\n 3. Bug Fixes\n\n [HCL-412] - Fixed a bug where the NGINX listening address was incorrectly displayed\n\n [HCL-452] - Fixed a bug where an IIS binding listening on all addresses could sometimes not be managed by the client\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Horizon Cli 1.11.1 release notes", "keywords": [ "horizon", "cli", - "10", + "11", "release", "notes", "release-notes", @@ -773,27 +773,27 @@ ] }, { - "page_id": "horizon-cli:1.10:release-notes:1.10.1", + "page_id": "horizon-cli:1.11:release-notes:1.11.1", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", - "title": "Horizon Cli 1.10.1 release notes", + "version": "1.11", + "title": "Horizon Cli 1.11.1 release notes", "section": "release-notes", - "slug": "release-notes/1.10.1", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/release-notes/1.10.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.10/release-notes/1.10.1.html", + "slug": "release-notes/1.11.1", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.1.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.1.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.10.1 release notes" + "Horizon Cli 1.11.1 release notes" ], - "summary": "Horizon Cli 1.10.1 release notes Here are the release notes for EverTrust Horizon Client v1.10.1, released on 2024-12-16. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon Cli 1.10.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.10.1, released on 2024-12-16.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-414] - ACME: HTTP-01 validation is now case insensitive\n\n 3. Bug Fixes\n\n [None]\n\n 4. Known Defects\n\n [None]\n\n Horizon Cli 1.10.2 release notes\n Horizon Cli 1.10.0 release notes", + "summary": "Horizon Cli 1.11.1 release notes Here are the release notes for EverTrust Horizon Client v1.11.1, released on 2025-04-14. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", + "content": "Horizon Cli 1.11.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.11.1, released on 2025-04-14.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-462] - Add --tls-insecure option to connect to on premise third parties\n\n 3. Bug Fixes\n\n [HCL-462] - Adding a CA to the client root CA config will no longer discard system-trusted CAs\n\n 4. Known Defects\n\n [None]\n\n Horizon Cli 1.11.2 release notes\n Horizon Cli 1.11.0 release notes", "keywords": [ "horizon", "cli", - "10", + "11", "release", "notes", "release-notes", @@ -802,27 +802,27 @@ ] }, { - "page_id": "horizon-cli:1.10:release-notes:1.10.2", + "page_id": "horizon-cli:1.11:release-notes:1.11.2", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", - "title": "Horizon Cli 1.10.2 release notes", + "version": "1.11", + "title": "Horizon Cli 1.11.2 release notes", "section": "release-notes", - "slug": "release-notes/1.10.2", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/release-notes/1.10.2.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.10/release-notes/1.10.2.html", + "slug": "release-notes/1.11.2", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.2.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.2.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.10.2 release notes" + "Horizon Cli 1.11.2 release notes" ], - "summary": "Horizon Cli 1.10.2 release notes Here are the release notes for EverTrust Horizon Client v1.10.2, released on 2025-01-13. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-4", - "content": "Horizon Cli 1.10.2 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.10.2, released on 2025-01-13.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-403] - Added F5 AS3 certificate discovery\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HCL-421] - Fixed a bug where automate init commands would fail when using the --request-challenge option\n\n [HCL-419] - CA Chain now contains all the chain certificates in scep enroll and scep renew\n\n [HCL-420] - automate remove with the --revoke options now works properly for acme-external profiles\n\n [HCL-424] - Fixed a bug where WebRA renew failed with Horizon 2.7\n\n [HCL-425] - chgrp is no longer executed on local horizon-cli install files\n\n 4. Known Defects\n\n [None]\n\n Horizon Cli 1.10.3 release notes\n Horizon Cli 1.10.1 release notes", + "summary": "Horizon Cli 1.11.2 release notes Here are the release notes for EverTrust Horizon Client v1.11.2, released on 2025-05-16. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", + "content": "Horizon Cli 1.11.2 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.11.2, released on 2025-05-16.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-470] - Localscan can now run without admin privileges\n\n [HCL-469] - Localscan now detects multiple certificates when opening certificate containers (PKCS#12, JKS)\n\n [HCL-466] - Localscan no longer errors when inputting invalid paths\n\n [HCL-467] - Credentials are no longer enforced on the client side\n\n [HCL-471] - Improve AIX support\n\n 3. Bug Fixes\n\n [HCL-472] - Improper label format in bulk operation commands no longer causes a panic\n\n 4. Known Defects\n\n [None]\n\n Horizon Cli 1.11.3 release notes\n Horizon Cli 1.11.1 release notes", "keywords": [ "horizon", "cli", - "10", + "11", "release", "notes", "release-notes", @@ -831,27 +831,27 @@ ] }, { - "page_id": "horizon-cli:1.10:release-notes:1.10.3", + "page_id": "horizon-cli:1.11:release-notes:1.11.3", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", - "title": "Horizon Cli 1.10.3 release notes", + "version": "1.11", + "title": "Horizon Cli 1.11.3 release notes", "section": "release-notes", - "slug": "release-notes/1.10.3", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/release-notes/1.10.3.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.10/release-notes/1.10.3.html", + "slug": "release-notes/1.11.3", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.3.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.3.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.10.3 release notes" + "Horizon Cli 1.11.3 release notes" ], - "summary": "Horizon Cli 1.10.3 release notes Here are the release notes for EverTrust Horizon Client v1.10.3, released on 2025-02-27. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-3", - "content": "Horizon Cli 1.10.3 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.10.3, released on 2025-02-27.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-368] - Added netimport support for Globalsign certificates\n\n [HCL-436] - Routine now has a --automation-policies option to execute routine on specific automation policies\n\n 2. Enhancements\n\n [HCL-430] - C, O and OU DN elements are now available on automate commands\n\n [HCL-440] - Added TACACS Login support for F5 discovery\n\n 3. Bug Fixes\n\n [HCL-441] - Admin rights are no longer checked on automate commands\n\n [HCL-442] - chgrp is no longer executed on local horizon-cli backup files\n\n [HCL-445] - Fixed a bug affecting automatic renewal of certificates in the Windows store\n\n 4. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.10.2 release notes", + "summary": "Horizon Cli 1.11.3 release notes Here are the release notes for EverTrust Horizon Client v1.11.3, released on 2025-05-28. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", + "content": "Horizon Cli 1.11.3 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.11.3, released on 2025-05-28.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-477] - Localscan: KDB files are now handled as keystores in discovery events\n\n 3. Bug Fixes\n\n [HCL-478] - Certificates containing negative serial numbers are properly handled again\n\n 4. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.11.2 release notes", "keywords": [ "horizon", "cli", - "10", + "11", "release", "notes", "release-notes", @@ -860,32 +860,32 @@ ] }, { - "page_id": "horizon-cli:1.10:requirements.html", + "page_id": "horizon-cli:1.11:requirements.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "Requirements", "section": "requirements.html", "slug": "requirements.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/requirements.html", "breadcrumbs": ["Horizon Client", "Requirements"], "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", - "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", + "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", "keywords": ["requirements", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.10:scep.html", + "page_id": "horizon-cli:1.11:scep.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "SCEP Certificate Lifecycle Operations", "section": "scep.html", "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -903,16 +903,16 @@ ] }, { - "page_id": "horizon-cli:1.10:update.html", + "page_id": "horizon-cli:1.11:update.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "Update operations", "section": "update.html", "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -927,16 +927,16 @@ ] }, { - "page_id": "horizon-cli:1.10:webra.html", + "page_id": "horizon-cli:1.11:webra.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.10", + "version": "1.11", "title": "WebRA Certificate Lifecycle Operations", "section": "webra.html", "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.10/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.11/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -954,22 +954,22 @@ ] }, { - "page_id": "horizon-cli:1.11:automation.html", + "page_id": "horizon-cli:1.12:automation.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "Automation", "section": "automation.html", "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" ], "summary": "Automation The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly usef", - "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n Routine\n\n Table 27. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 28. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 29. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 30. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 31. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 32. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.11.3 release notes", + "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 27. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 28. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 29. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 30. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 31. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 32. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.12.3 release notes", "keywords": [ "automation", "html", @@ -982,51 +982,51 @@ ] }, { - "page_id": "horizon-cli:1.11:basic.html", + "page_id": "horizon-cli:1.12:basic.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "Basic commands", "section": "basic.html", "slug": "basic.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", "keywords": ["basic", "commands", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.11:bulk.html", + "page_id": "horizon-cli:1.12:bulk.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "Bulk operations", "section": "bulk.html", "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", "keywords": ["bulk", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.11:config.html", + "page_id": "horizon-cli:1.12:config.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "General Configuration and Usage", "section": "config.html", "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", - "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", + "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", "keywords": [ "general", "configuration", @@ -1039,32 +1039,32 @@ ] }, { - "page_id": "horizon-cli:1.11:discovery.html", + "page_id": "horizon-cli:1.12:discovery.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "Discovery Operations", "section": "discovery.html", "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", - "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", + "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", "keywords": ["discovery", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.11:est.html", + "page_id": "horizon-cli:1.12:est.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "EST Certificate Lifecycle Operations", "section": "est.html", "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -1079,59 +1079,59 @@ ] }, { - "page_id": "horizon-cli:1.11:import.html", + "page_id": "horizon-cli:1.12:import.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "Import Operations", "section": "import.html", "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", + "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", "keywords": ["import", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.11:introduction.html", + "page_id": "horizon-cli:1.12:introduction.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "Introduction", "section": "introduction.html", "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.11 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", + "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.12 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", "keywords": ["introduction", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.11:release-notes:1.11.0", + "page_id": "horizon-cli:1.12:release-notes:1.12.0", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", - "title": "Horizon Cli 1.11.0 release notes", + "version": "1.12", + "title": "Horizon Cli 1.12.0 release notes", "section": "release-notes", - "slug": "release-notes/1.11.0", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.0.html", + "slug": "release-notes/1.12.0", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.0.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.0.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.11.0 release notes" + "Horizon Cli 1.12.0 release notes" ], - "summary": "Horizon Cli 1.11.0 release notes Here are the release notes for EverTrust Horizon Client v1.11.0, released on 2025-04-11. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-4", - "content": "Horizon Cli 1.11.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.11.0, released on 2025-04-11.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-407] - Added the --select-certs flag to select webserver certificates without interaction. Learn more\n\n [HCL-404] - Added the haproxy target\n\n [HCL-449] - Certificate storage info is now available in post-enrollment script. Learn more\n\n [HCL-453] - Netimport: added support for Akamai CPS\n\n 2. Enhancements\n\n [HCL-454] - Netimport: credentials can now be given using environment variables\n\n [HCL-455] - Localscan: added --all-certs to retrieve all certs regardless of usage, and --all-paths to scan the whole filesystem\n\n [HCL-456] - Generic automation:\n\n automate control can now control generic certificates outside of the standard folder\n\n windows store entry storage now removes excess certificates when not using --no-install\n\n 3. Bug Fixes\n\n [HCL-412] - Fixed a bug where the NGINX listening address was incorrectly displayed\n\n [HCL-452] - Fixed a bug where an IIS binding listening on all addresses could sometimes not be managed by the client\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Horizon Cli 1.11.1 release notes", + "summary": "Horizon Cli 1.12.0 release notes Here are the release notes for EverTrust Horizon Client v1.12.0, released on 2025-06-23. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-3", + "content": "Horizon Cli 1.12.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.12.0, released on 2025-06-23.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-366] - Netimport: Now supports Gandi\n\n [HCL-476] - IIS: Initialization can now be performed independently for each site\n\n [HCL-479] - Configuration: An external proxy can now be configured to connect to non-Horizon services (e.g., ACME External, third parties to scan, etc.)\n\n [HCL-485] - Localscan: Execution can now be scheduled\n\n [HCL-486] - Configuration: Commands requiring sudo can now be specified\n\n 2. Enhancements\n\n [HCL-487] - Uninstalling the client via MSI or RPM now also removes scheduled tasks\n\n 3. Bug Fixes\n\n [HCL-484] - Fixed a bug where the WinHorizon service could fail to locate certificates in the Windows store\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [HCL-490] - MSI packaging cannot be uninstalled. Upgrade to 1.12.1 and then uninstall to fix the issue\n\n Horizon Cli 1.12.1 release notes", "keywords": [ "horizon", "cli", - "11", + "12", "release", "notes", "release-notes", @@ -1140,27 +1140,27 @@ ] }, { - "page_id": "horizon-cli:1.11:release-notes:1.11.1", + "page_id": "horizon-cli:1.12:release-notes:1.12.1", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", - "title": "Horizon Cli 1.11.1 release notes", + "version": "1.12", + "title": "Horizon Cli 1.12.1 release notes", "section": "release-notes", - "slug": "release-notes/1.11.1", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.1.html", + "slug": "release-notes/1.12.1", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.1.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.1.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.11.1 release notes" + "Horizon Cli 1.12.1 release notes" ], - "summary": "Horizon Cli 1.11.1 release notes Here are the release notes for EverTrust Horizon Client v1.11.1, released on 2025-04-14. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon Cli 1.11.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.11.1, released on 2025-04-14.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-462] - Add --tls-insecure option to connect to on premise third parties\n\n 3. Bug Fixes\n\n [HCL-462] - Adding a CA to the client root CA config will no longer discard system-trusted CAs\n\n 4. Known Defects\n\n [None]\n\n Horizon Cli 1.11.2 release notes\n Horizon Cli 1.11.0 release notes", + "summary": "Horizon Cli 1.12.1 release notes Here are the release notes for EverTrust Horizon Client v1.12.1, released on 2025-06-24. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", + "content": "Horizon Cli 1.12.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.12.1, released on 2025-06-24.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HCL-490] - Fixed a bug where the MSI packaging could not be uninstalled\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Horizon Cli 1.12.2 release notes\n Horizon Cli 1.12.0 release notes", "keywords": [ "horizon", "cli", - "11", + "12", "release", "notes", "release-notes", @@ -1169,27 +1169,27 @@ ] }, { - "page_id": "horizon-cli:1.11:release-notes:1.11.2", + "page_id": "horizon-cli:1.12:release-notes:1.12.2", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", - "title": "Horizon Cli 1.11.2 release notes", + "version": "1.12", + "title": "Horizon Cli 1.12.2 release notes", "section": "release-notes", - "slug": "release-notes/1.11.2", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.2.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.2.html", + "slug": "release-notes/1.12.2", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.2.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.2.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.11.2 release notes" + "Horizon Cli 1.12.2 release notes" ], - "summary": "Horizon Cli 1.11.2 release notes Here are the release notes for EverTrust Horizon Client v1.11.2, released on 2025-05-16. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon Cli 1.11.2 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.11.2, released on 2025-05-16.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-470] - Localscan can now run without admin privileges\n\n [HCL-469] - Localscan now detects multiple certificates when opening certificate containers (PKCS#12, JKS)\n\n [HCL-466] - Localscan no longer errors when inputting invalid paths\n\n [HCL-467] - Credentials are no longer enforced on the client side\n\n [HCL-471] - Improve AIX support\n\n 3. Bug Fixes\n\n [HCL-472] - Improper label format in bulk operation commands no longer causes a panic\n\n 4. Known Defects\n\n [None]\n\n Horizon Cli 1.11.3 release notes\n Horizon Cli 1.11.1 release notes", + "summary": "Horizon Cli 1.12.2 release notes Here are the release notes for EverTrust Horizon Client v1.12.2, released on 2025-07-01. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", + "content": "Horizon Cli 1.12.2 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.12.2, released on 2025-07-01.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HCL-494] - IIS: Fixed a bug when installing on a website configured with hostname\n\n [HCL-503] - Fixed a bug where multiple requests could be added for the same binding\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Horizon Cli 1.12.3 release notes\n Horizon Cli 1.12.1 release notes", "keywords": [ "horizon", "cli", - "11", + "12", "release", "notes", "release-notes", @@ -1198,27 +1198,27 @@ ] }, { - "page_id": "horizon-cli:1.11:release-notes:1.11.3", + "page_id": "horizon-cli:1.12:release-notes:1.12.3", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", - "title": "Horizon Cli 1.11.3 release notes", + "version": "1.12", + "title": "Horizon Cli 1.12.3 release notes", "section": "release-notes", - "slug": "release-notes/1.11.3", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.3.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.11/release-notes/1.11.3.html", + "slug": "release-notes/1.12.3", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.3.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.3.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.11.3 release notes" + "Horizon Cli 1.12.3 release notes" ], - "summary": "Horizon Cli 1.11.3 release notes Here are the release notes for EverTrust Horizon Client v1.11.3, released on 2025-05-28. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon Cli 1.11.3 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.11.3, released on 2025-05-28.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-477] - Localscan: KDB files are now handled as keystores in discovery events\n\n 3. Bug Fixes\n\n [HCL-478] - Certificates containing negative serial numbers are properly handled again\n\n 4. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.11.2 release notes", + "summary": "Horizon Cli 1.12.3 release notes Here are the release notes for EverTrust Horizon Client v1.12.3, released on 2025-10-23. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", + "content": "Horizon Cli 1.12.3 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.12.3, released on 2025-10-23.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-508] - Automation (EST/SCEP): remove --revoke now uses PoP revocation when necessary\n\n [HCL-511] - Automation (ACME): remove --revoke now uses PoP revocation when --account is not specified\n\n [HCL-515] - Automation (ACME): add EAB options on control\n\n 3. Bug Fixes\n\n [HCL-519] - Fixed an issue impersonating a non-root user as root would try to access root configuration\n\n [HCL-505] - Automation:\n\n Fixed an issue where no-install flag installed certificate when renewing certificates\n\n Fixed an issue where no-install would not update state for certificates in the windows store\n\n [HCL-507] - IIS: Fixed an issue where installation of the certificate on renewal would fail on Windows 2016 and prior\n\n [HCL-513] - F5 IControl: Fixed an issue where DER certificates could not be discovered\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.12.2 release notes", "keywords": [ "horizon", "cli", - "11", + "12", "release", "notes", "release-notes", @@ -1227,32 +1227,32 @@ ] }, { - "page_id": "horizon-cli:1.11:requirements.html", + "page_id": "horizon-cli:1.12:requirements.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "Requirements", "section": "requirements.html", "slug": "requirements.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/requirements.html", "breadcrumbs": ["Horizon Client", "Requirements"], "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", "keywords": ["requirements", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.11:scep.html", + "page_id": "horizon-cli:1.12:scep.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "SCEP Certificate Lifecycle Operations", "section": "scep.html", "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -1270,16 +1270,16 @@ ] }, { - "page_id": "horizon-cli:1.11:update.html", + "page_id": "horizon-cli:1.12:update.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "Update operations", "section": "update.html", "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -1294,16 +1294,16 @@ ] }, { - "page_id": "horizon-cli:1.11:webra.html", + "page_id": "horizon-cli:1.12:webra.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.11", + "version": "1.12", "title": "WebRA Certificate Lifecycle Operations", "section": "webra.html", "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.11/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.12/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -1321,22 +1321,22 @@ ] }, { - "page_id": "horizon-cli:1.12:automation.html", + "page_id": "horizon-cli:1.13:automation.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "Automation", "section": "automation.html", "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" ], "summary": "Automation The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly usef", - "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 27. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 28. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 29. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 30. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 31. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 32. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.12.3 release notes", + "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 27. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 28. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 29. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 30. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 31. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 32. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.13.0 release notes", "keywords": [ "automation", "html", @@ -1349,48 +1349,48 @@ ] }, { - "page_id": "horizon-cli:1.12:basic.html", + "page_id": "horizon-cli:1.13:basic.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "Basic commands", "section": "basic.html", "slug": "basic.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", "keywords": ["basic", "commands", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.12:bulk.html", + "page_id": "horizon-cli:1.13:bulk.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "Bulk operations", "section": "bulk.html", "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", "keywords": ["bulk", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.12:config.html", + "page_id": "horizon-cli:1.13:config.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "General Configuration and Usage", "section": "config.html", "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", @@ -1406,32 +1406,32 @@ ] }, { - "page_id": "horizon-cli:1.12:discovery.html", + "page_id": "horizon-cli:1.13:discovery.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "Discovery Operations", "section": "discovery.html", "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", "keywords": ["discovery", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.12:est.html", + "page_id": "horizon-cli:1.13:est.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "EST Certificate Lifecycle Operations", "section": "est.html", "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -1446,146 +1446,59 @@ ] }, { - "page_id": "horizon-cli:1.12:import.html", + "page_id": "horizon-cli:1.13:import.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "Import Operations", "section": "import.html", "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", + "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Discovery Operations\n EST Certificate Lifecycle Operations", "keywords": ["import", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.12:introduction.html", + "page_id": "horizon-cli:1.13:introduction.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "Introduction", "section": "introduction.html", "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.12 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", + "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.13 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", "keywords": ["introduction", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.12:release-notes:1.12.0", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.12", - "title": "Horizon Cli 1.12.0 release notes", - "section": "release-notes", - "slug": "release-notes/1.12.0", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.0.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.12.0 release notes" - ], - "summary": "Horizon Cli 1.12.0 release notes Here are the release notes for EverTrust Horizon Client v1.12.0, released on 2025-06-23. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-3", - "content": "Horizon Cli 1.12.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.12.0, released on 2025-06-23.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-366] - Netimport: Now supports Gandi\n\n [HCL-476] - IIS: Initialization can now be performed independently for each site\n\n [HCL-479] - Configuration: An external proxy can now be configured to connect to non-Horizon services (e.g., ACME External, third parties to scan, etc.)\n\n [HCL-485] - Localscan: Execution can now be scheduled\n\n [HCL-486] - Configuration: Commands requiring sudo can now be specified\n\n 2. Enhancements\n\n [HCL-487] - Uninstalling the client via MSI or RPM now also removes scheduled tasks\n\n 3. Bug Fixes\n\n [HCL-484] - Fixed a bug where the WinHorizon service could fail to locate certificates in the Windows store\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [HCL-490] - MSI packaging cannot be uninstalled. Upgrade to 1.12.1 and then uninstall to fix the issue\n\n Horizon Cli 1.12.1 release notes", - "keywords": [ - "horizon", - "cli", - "12", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.12:release-notes:1.12.1", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.12", - "title": "Horizon Cli 1.12.1 release notes", - "section": "release-notes", - "slug": "release-notes/1.12.1", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.1.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.12.1 release notes" - ], - "summary": "Horizon Cli 1.12.1 release notes Here are the release notes for EverTrust Horizon Client v1.12.1, released on 2025-06-24. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon Cli 1.12.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.12.1, released on 2025-06-24.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HCL-490] - Fixed a bug where the MSI packaging could not be uninstalled\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Horizon Cli 1.12.2 release notes\n Horizon Cli 1.12.0 release notes", - "keywords": [ - "horizon", - "cli", - "12", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.12:release-notes:1.12.2", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.12", - "title": "Horizon Cli 1.12.2 release notes", - "section": "release-notes", - "slug": "release-notes/1.12.2", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.2.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.2.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.12.2 release notes" - ], - "summary": "Horizon Cli 1.12.2 release notes Here are the release notes for EverTrust Horizon Client v1.12.2, released on 2025-07-01. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon Cli 1.12.2 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.12.2, released on 2025-07-01.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HCL-494] - IIS: Fixed a bug when installing on a website configured with hostname\n\n [HCL-503] - Fixed a bug where multiple requests could be added for the same binding\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Horizon Cli 1.12.3 release notes\n Horizon Cli 1.12.1 release notes", - "keywords": [ - "horizon", - "cli", - "12", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.12:release-notes:1.12.3", + "page_id": "horizon-cli:1.13:release-notes:1.13.0", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", - "title": "Horizon Cli 1.12.3 release notes", + "version": "1.13", + "title": "Horizon Cli 1.13.0 release notes", "section": "release-notes", - "slug": "release-notes/1.12.3", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.3.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.12/release-notes/1.12.3.html", + "slug": "release-notes/1.13.0", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/release-notes/1.13.0.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.13/release-notes/1.13.0.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.12.3 release notes" + "Horizon Cli 1.13.0 release notes" ], - "summary": "Horizon Cli 1.12.3 release notes Here are the release notes for EverTrust Horizon Client v1.12.3, released on 2025-10-23. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon Cli 1.12.3 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.12.3, released on 2025-10-23.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-508] - Automation (EST/SCEP): remove --revoke now uses PoP revocation when necessary\n\n [HCL-511] - Automation (ACME): remove --revoke now uses PoP revocation when --account is not specified\n\n [HCL-515] - Automation (ACME): add EAB options on control\n\n 3. Bug Fixes\n\n [HCL-519] - Fixed an issue impersonating a non-root user as root would try to access root configuration\n\n [HCL-505] - Automation:\n\n Fixed an issue where no-install flag installed certificate when renewing certificates\n\n Fixed an issue where no-install would not update state for certificates in the windows store\n\n [HCL-507] - IIS: Fixed an issue where installation of the certificate on renewal would fail on Windows 2016 and prior\n\n [HCL-513] - F5 IControl: Fixed an issue where DER certificates could not be discovered\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.12.2 release notes", + "summary": "Horizon Cli 1.13.0 release notes Here are the release notes for EverTrust Horizon Client v1.13.0, released on 2025-10-23. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-5", + "content": "Horizon Cli 1.13.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.13.0, released on 2025-10-23.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-521] - Netimport: Now supports HashiCorp Vault\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [None]\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Automatic TLS Certificate Installation", "keywords": [ "horizon", "cli", - "12", + "13", "release", "notes", "release-notes", @@ -1594,32 +1507,32 @@ ] }, { - "page_id": "horizon-cli:1.12:requirements.html", + "page_id": "horizon-cli:1.13:requirements.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "Requirements", "section": "requirements.html", "slug": "requirements.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/requirements.html", "breadcrumbs": ["Horizon Client", "Requirements"], "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", "keywords": ["requirements", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.12:scep.html", + "page_id": "horizon-cli:1.13:scep.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "SCEP Certificate Lifecycle Operations", "section": "scep.html", "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -1637,16 +1550,16 @@ ] }, { - "page_id": "horizon-cli:1.12:update.html", + "page_id": "horizon-cli:1.13:update.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "Update operations", "section": "update.html", "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -1661,16 +1574,16 @@ ] }, { - "page_id": "horizon-cli:1.12:webra.html", + "page_id": "horizon-cli:1.13:webra.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.12", + "version": "1.13", "title": "WebRA Certificate Lifecycle Operations", "section": "webra.html", "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.12/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.13/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -1688,22 +1601,22 @@ ] }, { - "page_id": "horizon-cli:1.13:automation.html", + "page_id": "horizon-cli:1.14:automation.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "Automation", "section": "automation.html", "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" ], "summary": "Automation The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly usef", - "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 27. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 28. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 29. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 30. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 31. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 32. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.13.0 release notes", + "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Table 27. Modify Generic options\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 28. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 29. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 30. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 31. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 32. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 33. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.14.1 release notes", "keywords": [ "automation", "html", @@ -1716,48 +1629,48 @@ ] }, { - "page_id": "horizon-cli:1.13:basic.html", + "page_id": "horizon-cli:1.14:basic.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "Basic commands", "section": "basic.html", "slug": "basic.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", "keywords": ["basic", "commands", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.13:bulk.html", + "page_id": "horizon-cli:1.14:bulk.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "Bulk operations", "section": "bulk.html", "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", "keywords": ["bulk", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.13:config.html", + "page_id": "horizon-cli:1.14:config.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "General Configuration and Usage", "section": "config.html", "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", @@ -1773,32 +1686,32 @@ ] }, { - "page_id": "horizon-cli:1.13:discovery.html", + "page_id": "horizon-cli:1.14:discovery.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "Discovery Operations", "section": "discovery.html", "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", "keywords": ["discovery", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.13:est.html", + "page_id": "horizon-cli:1.14:est.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "EST Certificate Lifecycle Operations", "section": "est.html", "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -1813,59 +1726,59 @@ ] }, { - "page_id": "horizon-cli:1.13:import.html", + "page_id": "horizon-cli:1.14:import.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "Import Operations", "section": "import.html", "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Discovery Operations\n EST Certificate Lifecycle Operations", + "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n --merge-third-party enables fine tracking of the certificate across multiple SSL profiles. Enable this flag only with Horizon version superior or equal to 2.7.18\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Nameshield\n\n You can import all your certificates from Nameshield certificates.\n\n horizon-cli netimport nameshield --campaign=test --token=<token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", "keywords": ["import", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.13:introduction.html", + "page_id": "horizon-cli:1.14:introduction.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "Introduction", "section": "introduction.html", "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.13 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", + "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.14 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", "keywords": ["introduction", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.13:release-notes:1.13.0", + "page_id": "horizon-cli:1.14:release-notes:1.14.0", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", - "title": "Horizon Cli 1.13.0 release notes", + "version": "1.14", + "title": "Horizon Cli 1.14.0 release notes", "section": "release-notes", - "slug": "release-notes/1.13.0", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/release-notes/1.13.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.13/release-notes/1.13.0.html", + "slug": "release-notes/1.14.0", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/release-notes/1.14.0.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.14/release-notes/1.14.0.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.13.0 release notes" + "Horizon Cli 1.14.0 release notes" ], - "summary": "Horizon Cli 1.13.0 release notes Here are the release notes for EverTrust Horizon Client v1.13.0, released on 2025-10-23. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-5", - "content": "Horizon Cli 1.13.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.13.0, released on 2025-10-23.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-521] - Netimport: Now supports HashiCorp Vault\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [None]\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Automatic TLS Certificate Installation", + "summary": "Horizon Cli 1.14.0 release notes Here are the release notes for EverTrust Horizon Client v1.14.0, released on 2025-12-19. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-2", + "content": "Horizon Cli 1.14.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.14.0, released on 2025-12-19.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-257] - Netimport: Now supports Nameshield\n\n [HOR-247] - Automation: certificate chain order can now be specified\n\n [HOR-245] - Automation: KDB can now be used with the generic target, on machines that contain the required IBM utilities\n\n 2. Enhancements\n\n [HOR-365] - Netimport: HashiCorp Vault namespaces are now supported\n\n [HOR-131] - Automation: when enrolling, the --auto-renew task can now be created for a specific user using the --user parameter\n\n 3. Bug Fixes\n\n [HOR-244] - Fixed a bug where using the generic target with the --no-install parameter would raise an error\n\n [HOR-225] - Fixed a bug where ACME certificates would not contain the expected C and OU DN parameters when renewed\n\n [HOR-219] - Fixed a bug where the configuration folder was not properly detected when using the tomcat target\n\n [HOR-249] - Fixed a bug where AKV netimport would raise an error\n\n [HOR-259] - Fixed a bug where saving a certificate to the store would rarely result in a crash\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n An issue with MSI packaging in this version makes it impossible to uninstall. This issue does not affect version 1.14.1 . To resolve it, upgrade to 1.14.1 and then uninstall.\n\n Horizon Cli 1.14.1 release notes", "keywords": [ "horizon", "cli", - "13", + "14", "release", "notes", "release-notes", @@ -1874,32 +1787,61 @@ ] }, { - "page_id": "horizon-cli:1.13:requirements.html", + "page_id": "horizon-cli:1.14:release-notes:1.14.1", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", - "title": "Requirements", - "section": "requirements.html", - "slug": "requirements.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", - "breadcrumbs": ["Horizon Client", "Requirements"], - "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", - "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", + "version": "1.14", + "title": "Horizon Cli 1.14.1 release notes", + "section": "release-notes", + "slug": "release-notes/1.14.1", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/release-notes/1.14.1.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.14/release-notes/1.14.1.html", + "breadcrumbs": [ + "Horizon Client", + "Release notes", + "Horizon Cli 1.14.1 release notes" + ], + "summary": "Horizon Cli 1.14.1 release notes Here are the release notes for EverTrust Horizon Client v1.14.1, released on 2026-01-09. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", + "content": "Horizon Cli 1.14.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.14.1, released on 2026-01-09.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-359] - NetImport F5: added the --merge-third-party option to improve third party data tracking. Learn more…​\n\n 3. Bug Fixes\n\n [None]\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.14.0 release notes", + "keywords": [ + "horizon", + "cli", + "14", + "release", + "notes", + "release-notes", + "release-notes/1", + "client" + ] + }, + { + "page_id": "horizon-cli:1.14:requirements.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.14", + "title": "Requirements", + "section": "requirements.html", + "slug": "requirements.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/requirements.html", + "breadcrumbs": ["Horizon Client", "Requirements"], + "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", + "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", "keywords": ["requirements", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.13:scep.html", + "page_id": "horizon-cli:1.14:scep.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "SCEP Certificate Lifecycle Operations", "section": "scep.html", "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -1917,16 +1859,16 @@ ] }, { - "page_id": "horizon-cli:1.13:update.html", + "page_id": "horizon-cli:1.14:update.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "Update operations", "section": "update.html", "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -1941,16 +1883,16 @@ ] }, { - "page_id": "horizon-cli:1.13:webra.html", + "page_id": "horizon-cli:1.14:webra.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.13", + "version": "1.14", "title": "WebRA Certificate Lifecycle Operations", "section": "webra.html", "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.13/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.14/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -1968,22 +1910,22 @@ ] }, { - "page_id": "horizon-cli:1.14:automation.html", + "page_id": "horizon-cli:1.15:automation.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.14", + "version": "1.15", "title": "Automation", "section": "automation.html", "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" ], "summary": "Automation The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly usef", - "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Table 27. Modify Generic options\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 28. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 29. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 30. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 31. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 32. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 33. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.14.1 release notes", + "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, WebRA or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to control.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Table 27. Modify Generic options\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove --ids <id1>, …​, <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove --ids all command to remove all certificates from the local database.\n\n To select certificates to remove, another option is to use the --serials option with the serials of the certificates to remove.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 28. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 29. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 30. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 31. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 32. Remove parameters\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --ids\n\n string list\n\n Ids of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n --serials\n\n string list\n\n Serials of the certificates to remove. All linked services will be removed. See automate list to get the serial.\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove --ids all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove --ids nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove --ids nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove --ids nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore --ids tomcat-*:8443\n\n Bulk Operations\n Horizon-cli 1.15.1 release notes", "keywords": [ "automation", "html", @@ -1996,48 +1938,48 @@ ] }, { - "page_id": "horizon-cli:1.14:basic.html", + "page_id": "horizon-cli:1.15:basic.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.14", + "version": "1.15", "title": "Basic commands", "section": "basic.html", "slug": "basic.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", "keywords": ["basic", "commands", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.14:bulk.html", + "page_id": "horizon-cli:1.15:bulk.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.14", + "version": "1.15", "title": "Bulk operations", "section": "bulk.html", "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", "keywords": ["bulk", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.14:config.html", + "page_id": "horizon-cli:1.15:config.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.14", + "version": "1.15", "title": "General Configuration and Usage", "section": "config.html", "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", @@ -2053,35 +1995,35 @@ ] }, { - "page_id": "horizon-cli:1.14:discovery.html", + "page_id": "horizon-cli:1.15:discovery.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.14", + "version": "1.15", "title": "Discovery Operations", "section": "discovery.html", "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", - "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", + "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Scanned folders\n\n By default, localscan will scan these commonly used paths:\n\n On Unix: /usr/local/etc , /etc and /opt\n\n On Windows: user store , machine store , program data , program files , program files x86\n\n To disable scanning these paths, use the --exclude-default-paths option.\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", "keywords": ["discovery", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.14:est.html", + "page_id": "horizon-cli:1.15:est.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.14", + "version": "1.15", "title": "EST Certificate Lifecycle Operations", "section": "est.html", "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", - "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", + "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", "keywords": [ "est", "certificate", @@ -2093,59 +2035,59 @@ ] }, { - "page_id": "horizon-cli:1.14:import.html", + "page_id": "horizon-cli:1.15:import.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.14", + "version": "1.15", "title": "Import Operations", "section": "import.html", "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n --merge-third-party enables fine tracking of the certificate across multiple SSL profiles. Enable this flag only with Horizon version superior or equal to 2.7.18\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Nameshield\n\n You can import all your certificates from Nameshield certificates.\n\n horizon-cli netimport nameshield --campaign=test --token=<token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", "keywords": ["import", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.14:introduction.html", + "page_id": "horizon-cli:1.15:introduction.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.14", + "version": "1.15", "title": "Introduction", "section": "introduction.html", "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.14 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", + "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.15 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", "keywords": ["introduction", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.14:release-notes:1.14.0", + "page_id": "horizon-cli:1.15:release-notes:1.15.0", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.14", - "title": "Horizon Cli 1.14.0 release notes", + "version": "1.15", + "title": "Horizon Cli 1.15.0 release notes", "section": "release-notes", - "slug": "release-notes/1.14.0", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/release-notes/1.14.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.14/release-notes/1.14.0.html", + "slug": "release-notes/1.15.0", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/release-notes/1.15.0.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/release-notes/1.15.0.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.14.0 release notes" + "Horizon Cli 1.15.0 release notes" ], - "summary": "Horizon Cli 1.14.0 release notes Here are the release notes for EverTrust Horizon Client v1.14.0, released on 2025-12-19. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-2", - "content": "Horizon Cli 1.14.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.14.0, released on 2025-12-19.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-257] - Netimport: Now supports Nameshield\n\n [HOR-247] - Automation: certificate chain order can now be specified\n\n [HOR-245] - Automation: KDB can now be used with the generic target, on machines that contain the required IBM utilities\n\n 2. Enhancements\n\n [HOR-365] - Netimport: HashiCorp Vault namespaces are now supported\n\n [HOR-131] - Automation: when enrolling, the --auto-renew task can now be created for a specific user using the --user parameter\n\n 3. Bug Fixes\n\n [HOR-244] - Fixed a bug where using the generic target with the --no-install parameter would raise an error\n\n [HOR-225] - Fixed a bug where ACME certificates would not contain the expected C and OU DN parameters when renewed\n\n [HOR-219] - Fixed a bug where the configuration folder was not properly detected when using the tomcat target\n\n [HOR-249] - Fixed a bug where AKV netimport would raise an error\n\n [HOR-259] - Fixed a bug where saving a certificate to the store would rarely result in a crash\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n An issue with MSI packaging in this version makes it impossible to uninstall. This issue does not affect version 1.14.1 . To resolve it, upgrade to 1.14.1 and then uninstall.\n\n Horizon Cli 1.14.1 release notes", + "summary": "Horizon Cli 1.15.0 release notes Here are the release notes for EverTrust Horizon Client v1.15.0, released on 2026-02-16. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-6", + "content": "Horizon Cli 1.15.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.15.0, released on 2026-02-16.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-607] - Automation: --pfx-strength and --pfx-alias options allow defining the encryption level and alias for PKCS#12 files\n\n [HOR-521] - Automation: added --chain-key-bundle for generic enrollments to bundle the chain and private key in a single file\n\n [HOR-251] - Automation: added support for Evertrust’s WebRA protocol\n\n 2. Enhancements\n\n [HOR-553] - EST: --cn is no longer mandatory when using challenge mode\n\n [HOR-719] - Localscan: --exclude-default-paths is now available to exclude default localscan paths\n\n [HOR-733] - Keystores: improved JKS and KDB support to allow new alias creation as well as multiple aliases in the same file\n\n [HOR-731] - Added KDB support on all protocols\n\n [HOR-643] - Automate Remove: certificates can now be targeted by serial number using the --serials option\n\n 3. Bug Fixes\n\n [HOR-707] - KDB flags are now present in automate control help\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Horizon-cli 1.15.1 release notes", "keywords": [ "horizon", "cli", - "14", + "15", "release", "notes", "release-notes", @@ -2154,1486 +2096,67 @@ ] }, { - "page_id": "horizon-cli:1.14:release-notes:1.14.1", + "page_id": "horizon-cli:1.15:release-notes:1.15.1", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.14", - "title": "Horizon Cli 1.14.1 release notes", + "version": "1.15", + "title": "Horizon-cli 1.15.1 release notes", "section": "release-notes", - "slug": "release-notes/1.14.1", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/release-notes/1.14.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.14/release-notes/1.14.1.html", + "slug": "release-notes/1.15.1", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/release-notes/1.15.1.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/release-notes/1.15.1.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.14.1 release notes" + "Horizon-cli 1.15.1 release notes" ], - "summary": "Horizon Cli 1.14.1 release notes Here are the release notes for EverTrust Horizon Client v1.14.1, released on 2026-01-09. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon Cli 1.14.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.14.1, released on 2026-01-09.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-359] - NetImport F5: added the --merge-third-party option to improve third party data tracking. Learn more…​\n\n 3. Bug Fixes\n\n [None]\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.14.0 release notes", + "summary": "Horizon-cli 1.15.1 release notes Here are the release notes for EverTrust Horizon Client v1.15.1, released on 2026-02-27. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", + "content": "Horizon-cli 1.15.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.15.1, released on 2026-02-27.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-843] - KDB Password is now optional and the .sth file will be used if present\n\n 3. Bug Fixes\n\n [HOR-841] - Fixed various defects linked to KDB storage:\n\n Chain missing in protocol enrollments\n\n .sth/.rdb files missing in protocol enrollments\n\n automate control issues when .sth/.rdb or chain files are missing\n\n [HOR-810] - Fixed a crash that could occur when using the Windows certificate store\n\n [HOR-806] - automate revoke : fixed an issue where revoking the certificate using ACME failed if its private key was stored in the Windows certificate store\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.15.0 release notes", "keywords": [ - "horizon", - "cli", - "14", + "horizon-cli", + "15", "release", "notes", "release-notes", "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.14:requirements.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.14", - "title": "Requirements", - "section": "requirements.html", - "slug": "requirements.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", - "breadcrumbs": ["Horizon Client", "Requirements"], - "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", - "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", - "keywords": ["requirements", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.14:scep.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.14", - "title": "SCEP Certificate Lifecycle Operations", - "section": "scep.html", - "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", - "breadcrumbs": [ - "Horizon Client", - "SCEP Certificate Lifecycle Operations" - ], - "summary": "SCEP Certificate Lifecycle Operations The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode. Usage: horizon-cli scep [co", - "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Challenge password in decentralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the SCEP profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli scep enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the SCEP profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the SCEP request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli scep enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n horizon-cli scep enroll --profile=<profile> --challenge=<challenge> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Enrollment with lots of metadata and output as PKCS#12\n\n horizon-cli scep enroll \\\n --profile=<profile> \\\n --challenge=<challenge> \\\n --key-type=rsa-2048 \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n Renewal with output as key and certificate\n\n horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --cert=/path/to/cert --key=/path/to/key\n\n EST Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", - "keywords": [ - "scep", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.14:update.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.14", - "title": "Update operations", - "section": "update.html", - "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", - "breadcrumbs": ["Horizon Client", "Updating a certificate"], - "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", - "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", - "keywords": [ - "update", - "operations", - "html", - "horizon", - "client", - "updating", - "certificate" - ] - }, - { - "page_id": "horizon-cli:1.14:webra.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.14", - "title": "WebRA Certificate Lifecycle Operations", - "section": "webra.html", - "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.14/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", - "breadcrumbs": [ - "Horizon Client", - "WebRA Certificate Lifecycle Operations" - ], - "summary": "WebRA Certificate Lifecycle Operations The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation. WebRA operations validation Like SCEP and EST,", - "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n --ms-guid\n\n Requested Microsoft GUID. Single value\n\n --ms-sid\n\n Requested Microsoft SID. Single value\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Import\n\n The `webra import`command is designed to import a certificate and its key on a profile.\n\n Import parameters\n\n Table 11. WebRA import parameters\n\n Parameter\n\n Description\n\n --profile\n\n Existing profile on which to import\n\n Table 12. Metadata parameters\n\n Parameter\n\n Description\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --contact-email\n\n Contact email of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n --metadata\n\n Technical metadata of the imported certificate, in key:value form\n\n Input parameters\n\n These parameters define how to find the certificate to import. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 13. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to import (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to import if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to import\n\n --in-jks-pwd\n\n Password for the JKS file to import\n\n --in-jks-alias\n\n Alias for the certificate to import in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to import\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Revocation parameters\n\n Define how to revoke this certificate:\n\n Table 14. WebRA revocation parameters\n\n Parameter\n\n Description\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n Input parameters\n\n These parameters define how to find the certificate to revoke. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 15. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --in-jks-pwd\n\n Password for the JKS file to revoke\n\n --in-jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra enroll --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n horizon-cli webra enroll \\\n --profile=<profile> \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n after this command, run periodically:\n\n horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra renew --in-cert /path/to/old/cert --in-key /path/to/old/key --cert /path/to/cert --key /path/to/key --now\n\n Revocation of a certificate\n\n horizon-cli webra revoke --in-cert /path/to/cert --in-key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", - "keywords": [ - "webra", - "certificate", - "lifecycle", - "operations", - "html", "horizon", "client" ] }, { - "page_id": "horizon-cli:1.15:automation.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "Automation", - "section": "automation.html", - "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", - "breadcrumbs": [ - "Horizon Client", - "Automatic TLS Certificate Installation" - ], - "summary": "Automation The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly usef", - "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, WebRA or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to control.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --c\n\n string\n\n DN element Country, a two-letter country code\n\n --o\n\n string\n\n DN element Organization, the name of a company or organization\n\n --ou\n\n string array (comma separated)\n\n List of Organizational Unit, internal organization department/division names\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Table 27. Modify Generic options\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove --ids <id1>, …​, <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove --ids all command to remove all certificates from the local database.\n\n To select certificates to remove, another option is to use the --serials option with the serials of the certificates to remove.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 28. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 29. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 30. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 31. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 32. Remove parameters\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --ids\n\n string list\n\n Ids of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n --serials\n\n string list\n\n Serials of the certificates to remove. All linked services will be removed. See automate list to get the serial.\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove --ids all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove --ids nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove --ids nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove --ids nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore --ids tomcat-*:8443\n\n Bulk Operations\n Horizon-cli 1.15.1 release notes", - "keywords": [ - "automation", - "html", - "horizon", - "client", - "automatic", - "tls", - "certificate", - "installation" - ] - }, - { - "page_id": "horizon-cli:1.15:basic.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "Basic commands", - "section": "basic.html", - "slug": "basic.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", - "breadcrumbs": ["Horizon Client", "Basic commands"], - "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", - "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", - "keywords": ["basic", "commands", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.15:bulk.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "Bulk operations", - "section": "bulk.html", - "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", - "breadcrumbs": ["Horizon Client", "Bulk Operations"], - "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", - "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", - "keywords": ["bulk", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.15:config.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "General Configuration and Usage", - "section": "config.html", - "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", - "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], - "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", - "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", - "keywords": [ - "general", - "configuration", - "and", - "usage", - "config", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.15:discovery.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "Discovery Operations", - "section": "discovery.html", - "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", - "breadcrumbs": ["Horizon Client", "Discovery Operations"], - "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", - "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Scanned folders\n\n By default, localscan will scan these commonly used paths:\n\n On Unix: /usr/local/etc , /etc and /opt\n\n On Windows: user store , machine store , program data , program files , program files x86\n\n To disable scanning these paths, use the --exclude-default-paths option.\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", - "keywords": ["discovery", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.15:est.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "EST Certificate Lifecycle Operations", - "section": "est.html", - "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", - "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], - "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", - "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", - "keywords": [ - "est", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.15:import.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "Import Operations", - "section": "import.html", - "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", - "breadcrumbs": ["Horizon Client", "Import operations"], - "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n --merge-third-party enables fine tracking of the certificate across multiple SSL profiles. Enable this flag only with Horizon version superior or equal to 2.7.18\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Nameshield\n\n You can import all your certificates from Nameshield certificates.\n\n horizon-cli netimport nameshield --campaign=test --token=<token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", - "keywords": ["import", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.15:introduction.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "Introduction", - "section": "introduction.html", - "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", - "breadcrumbs": ["Horizon Client", "Introduction"], - "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.15 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", - "keywords": ["introduction", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.15:release-notes:1.15.0", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "Horizon Cli 1.15.0 release notes", - "section": "release-notes", - "slug": "release-notes/1.15.0", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/release-notes/1.15.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/release-notes/1.15.0.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.15.0 release notes" - ], - "summary": "Horizon Cli 1.15.0 release notes Here are the release notes for EverTrust Horizon Client v1.15.0, released on 2026-02-16. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-6", - "content": "Horizon Cli 1.15.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.15.0, released on 2026-02-16.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-607] - Automation: --pfx-strength and --pfx-alias options allow defining the encryption level and alias for PKCS#12 files\n\n [HOR-521] - Automation: added --chain-key-bundle for generic enrollments to bundle the chain and private key in a single file\n\n [HOR-251] - Automation: added support for Evertrust’s WebRA protocol\n\n 2. Enhancements\n\n [HOR-553] - EST: --cn is no longer mandatory when using challenge mode\n\n [HOR-719] - Localscan: --exclude-default-paths is now available to exclude default localscan paths\n\n [HOR-733] - Keystores: improved JKS and KDB support to allow new alias creation as well as multiple aliases in the same file\n\n [HOR-731] - Added KDB support on all protocols\n\n [HOR-643] - Automate Remove: certificates can now be targeted by serial number using the --serials option\n\n 3. Bug Fixes\n\n [HOR-707] - KDB flags are now present in automate control help\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Horizon-cli 1.15.1 release notes", - "keywords": [ - "horizon", - "cli", - "15", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.15:release-notes:1.15.1", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "Horizon-cli 1.15.1 release notes", - "section": "release-notes", - "slug": "release-notes/1.15.1", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/release-notes/1.15.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/release-notes/1.15.1.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon-cli 1.15.1 release notes" - ], - "summary": "Horizon-cli 1.15.1 release notes Here are the release notes for EverTrust Horizon Client v1.15.1, released on 2026-02-27. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon-cli 1.15.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.15.1, released on 2026-02-27.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-843] - KDB Password is now optional and the .sth file will be used if present\n\n 3. Bug Fixes\n\n [HOR-841] - Fixed various defects linked to KDB storage:\n\n Chain missing in protocol enrollments\n\n .sth/.rdb files missing in protocol enrollments\n\n automate control issues when .sth/.rdb or chain files are missing\n\n [HOR-810] - Fixed a crash that could occur when using the Windows certificate store\n\n [HOR-806] - automate revoke : fixed an issue where revoking the certificate using ACME failed if its private key was stored in the Windows certificate store\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.15.0 release notes", - "keywords": [ - "horizon-cli", - "15", - "release", - "notes", - "release-notes", - "release-notes/1", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.15:requirements.html", + "page_id": "horizon-cli:1.15:requirements.html", "product": "horizon-cli", "kind": "companion", "source": "antora", "version": "1.15", "title": "Requirements", "section": "requirements.html", - "slug": "requirements.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", - "breadcrumbs": ["Horizon Client", "Requirements"], - "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", - "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit);\n\n Introduction\n General Configuration and Usage", - "keywords": ["requirements", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.15:scep.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "SCEP Certificate Lifecycle Operations", - "section": "scep.html", - "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", - "breadcrumbs": [ - "Horizon Client", - "SCEP Certificate Lifecycle Operations" - ], - "summary": "SCEP Certificate Lifecycle Operations The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode. Usage: horizon-cli scep [co", - "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Challenge password in decentralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the SCEP profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli scep enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the SCEP profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the SCEP request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli scep enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n horizon-cli scep enroll --profile=<profile> --challenge=<challenge> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Enrollment with lots of metadata and output as PKCS#12\n\n horizon-cli scep enroll \\\n --profile=<profile> \\\n --challenge=<challenge> \\\n --key-type=rsa-2048 \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n Renewal with output as key and certificate\n\n horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --cert=/path/to/cert --key=/path/to/key\n\n EST Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", - "keywords": [ - "scep", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.15:update.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "Update operations", - "section": "update.html", - "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", - "breadcrumbs": ["Horizon Client", "Updating a certificate"], - "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", - "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", - "keywords": [ - "update", - "operations", - "html", - "horizon", - "client", - "updating", - "certificate" - ] - }, - { - "page_id": "horizon-cli:1.15:webra.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.15", - "title": "WebRA Certificate Lifecycle Operations", - "section": "webra.html", - "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", - "breadcrumbs": [ - "Horizon Client", - "WebRA Certificate Lifecycle Operations" - ], - "summary": "WebRA Certificate Lifecycle Operations The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation. WebRA operations validation Like SCEP and EST,", - "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n --ms-guid\n\n Requested Microsoft GUID. Single value\n\n --ms-sid\n\n Requested Microsoft SID. Single value\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Import\n\n The `webra import`command is designed to import a certificate and its key on a profile.\n\n Import parameters\n\n Table 11. WebRA import parameters\n\n Parameter\n\n Description\n\n --profile\n\n Existing profile on which to import\n\n Table 12. Metadata parameters\n\n Parameter\n\n Description\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --contact-email\n\n Contact email of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n --metadata\n\n Technical metadata of the imported certificate, in key:value form\n\n Input parameters\n\n These parameters define how to find the certificate to import. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 13. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to import (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to import if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to import\n\n --in-jks-pwd\n\n Password for the JKS file to import\n\n --in-jks-alias\n\n Alias for the certificate to import in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to import\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Revocation parameters\n\n Define how to revoke this certificate:\n\n Table 14. WebRA revocation parameters\n\n Parameter\n\n Description\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n Input parameters\n\n These parameters define how to find the certificate to revoke. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 15. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --in-jks-pwd\n\n Password for the JKS file to revoke\n\n --in-jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra enroll --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n horizon-cli webra enroll \\\n --profile=<profile> \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n after this command, run periodically:\n\n horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra renew --in-cert /path/to/old/cert --in-key /path/to/old/key --cert /path/to/cert --key /path/to/key --now\n\n Revocation of a certificate\n\n horizon-cli webra revoke --in-cert /path/to/cert --in-key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", - "keywords": [ - "webra", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.16:automation.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "Automation", - "section": "automation.html", - "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", - "breadcrumbs": [ - "Horizon Client", - "Automatic TLS Certificate Installation" - ], - "summary": "Automation The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly usef", - "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n edit\n\n This command allows the user to change values on the state of currently managed certificates.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, WebRA or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to control.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Table 27. Modify Generic options\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Edit\n\n The edit command allows to change automation data on managed certificates.\n\n Parameters\n\n Table 28. Edit selection parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --ids\n\n string array (comma separated)\n\n Identifiers of the services to edit. Supports glob syntax\n\n --serials\n\n string array (comma separated)\n\n Serial numbers of the certificates to edit all its services\n\n Table 29. Edit state parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --no-install\n\n boolean\n\n Change the no-install value for targeted services\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove --ids <id1>, …​, <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove --ids all command to remove all certificates from the local database.\n\n To select certificates to remove, another option is to use the --serials option with the serials of the certificates to remove.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 30. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 31. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 32. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 33. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 34. Remove parameters\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --ids\n\n string list\n\n Ids of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n --serials\n\n string list\n\n Serials of the certificates to remove. All linked services will be removed. See automate list to get the serial.\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove --ids all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove --ids nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove --ids nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove --ids nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore --ids tomcat-*:8443\n\n Bulk Operations\n Horizon-cli 1.16.1 release notes", - "keywords": [ - "automation", - "html", - "horizon", - "client", - "automatic", - "tls", - "certificate", - "installation" - ] - }, - { - "page_id": "horizon-cli:1.16:basic.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "Basic commands", - "section": "basic.html", - "slug": "basic.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", - "breadcrumbs": ["Horizon Client", "Basic commands"], - "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", - "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", - "keywords": ["basic", "commands", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.16:bulk.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "Bulk operations", - "section": "bulk.html", - "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", - "breadcrumbs": ["Horizon Client", "Bulk Operations"], - "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", - "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", - "keywords": ["bulk", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.16:config.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "General Configuration and Usage", - "section": "config.html", - "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", - "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], - "summary": "General Configuration and Usage Installation Package install/uninstall Installing the package RPM Windows Binary Installing from the Evertrust repository Create a /etc/yum.repos.d/horizon-cli.repo file containing the EverTrust repository in", - "content": "General Configuration and Usage\n\n Installation\n\n Package install/uninstall\n\n Installing the package\n\n RPM\n\n Windows\n\n Binary\n\n Installing from the Evertrust repository\n\n Create a /etc/yum.repos.d/horizon-cli.repo file containing the EverTrust repository info:\n\n [horizon-cli]\nenabled=1\nname=Horizon Client Repository\nbaseurl=https://repo.evertrust.io/repository/horizon-cli-rpm/\ngpgcheck=1\ngpgkey=https://evertrust.io/.well-known/rpm/gpg.pub\nusername=<username>\npassword=<password>\n\n Replace <username> and <password> with the credentials you were provided.\n\n Make sure the Evertrust GPG key is trusted:\n\n # rpm --import https://evertrust.io/.well-known/rpm/gpg.pub\n\n You can then run the following to install the latest Horizon Client version:\n\n # yum install horizon-cli\n\n To prevent unattended upgrades when running yum update, you should pin the Horizon Client version by adding\n\n exclude=horizon-cli\n\n at the end of the /etc/yum.repos.d/horizon-cli.repo file after installing Horizon Client.\n\n Installing from the package file\n\n Download the latest RPM for Horizon Client on the Official EVERTRUST repository .\n\n Upload the file ' horizon-cli-<latest>.x86_64.rpm ' to the server;\n\n Access the server with an account with administrative privileges;\n\n Install the Horizon Client package with the following command:\n\n # yum localinstall /root/horizon-cli-<latest>.x86_64.rpm\n\n If you wish to verify the signature of the RPM package, the EVERTRUST key can be added to your trusted keys using the following command:\n\n # rpm --import https://evertrust.io/.well-known/rpm/gpg.pub\n\n The signature can then be verified using the following command:\n\n # rpm -K /root/horizon-cli-<latest>.x86_64.rpm\n\n To install the package, double click on the MSI file and follow the instructions.\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the PATH , in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n # chmod +x horizon-cli.bin\n\n Uninstalling the package\n\n RPM\n\n Windows\n\n Binary\n\n # yum remove horizon-cli\n\n To uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Remove the binary file from your system, and remove it from PATH\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n $ horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n $ horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\n Configuration customization\n\n Changing the configuration file location\n\n In case you want to change the configuration file location, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\n Changing all horizon-client files location\n\n Additional files are used by the client (automation state, log files, etc). In case you want to change the path to these configurations, the HRZ_LOCAL_DATA environment variable can contain an absolute path to a folder, and will create all necessary files starting from this folder.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n $ horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", - "keywords": [ - "general", - "configuration", - "and", - "usage", - "config", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.16:discovery.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "Discovery Operations", - "section": "discovery.html", - "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", - "breadcrumbs": ["Horizon Client", "Discovery Operations"], - "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", - "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Scanned folders\n\n By default, localscan will scan these commonly used paths:\n\n On Unix: /usr/local/etc , /etc and /opt\n\n On Windows: user store , machine store , program data , program files , program files x86\n\n To disable scanning these paths, use the --exclude-default-paths option.\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n If you wish to also scan the TLS versions and supported cipher suites of the scanned ports, you can use the --scan-supported-tls option.\n\n Due to technical limitations in the GO runtime, some cipher suites cannot be tested.\n\n The recommended approach is to import an nmap scan using nmap import .\n\n Supported cipher suites\n\n TLS_AES_128_GCM_SHA256\n\n TLS_AES_256_GCM_SHA384\n\n TLS_CHACHA20_POLY1305_SHA256\n\n TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA\n\n TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA\n\n TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\n\n TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\n\n TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\n\n TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\n\n TLS_RSA_WITH_RC4_128_SHA\n\n TLS_RSA_WITH_3DES_EDE_CBC_SHA\n\n TLS_RSA_WITH_AES_128_CBC_SHA\n\n TLS_RSA_WITH_AES_256_CBC_SHA\n\n TLS_RSA_WITH_AES_128_CBC_SHA256\n\n TLS_RSA_WITH_AES_128_GCM_SHA256\n\n TLS_RSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_ECDSA_WITH_RC4_128_SHA\n\n TLS_ECDHE_RSA_WITH_RC4_128_SHA\n\n TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256\n\n TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256\n\n Source : https://go.dev/src/crypto/tls/cipher_suites.go\n\n horizon-cli netscan --campaign=test --scan-supported-tls\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n If the ssl-enum-ciphers was also used on the scan, the TLS ciphers for the certificates will also be sent to Horizon.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into Horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Tenable.sc Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Tenable.sc into Horizon.\n\n To utilize this feature, you need to ensure that you have valid credentials for Tenable.sc with the necessary permissions to access and export scan data and the scan name on which you want to perform the import. Additionally, you must know your Tenable.sc hostname through which Horizon Client will communicate with the Tenable.sc API and use the \"SSL Certificate Information\" plugin output to get the certificates into Horizon.\n\n horizon-cli importscan tenable-sc --campaign=<campaign> --scan-name=<name of the scan> --hostname=<tenable.sc instance>\n\n Basic commands\n Import operations", - "keywords": ["discovery", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.16:est.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "EST Certificate Lifecycle Operations", - "section": "est.html", - "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", - "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], - "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", - "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", - "keywords": [ - "est", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.16:import.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "Import Operations", - "section": "import.html", - "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", - "breadcrumbs": ["Horizon Client", "Import operations"], - "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n --merge-third-party enables fine tracking of the certificate across multiple SSL profiles. Enable this flag only with Horizon version superior or equal to 2.7.18\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Nameshield\n\n You can import all your certificates from Nameshield certificates.\n\n horizon-cli netimport nameshield --campaign=test --token=<token>\n\n Panorama\n\n You can import all your certificates from PaloAlto Panorama.\n\n The required permissions for the scan operation are:\n\n XML API: Configuration\n\n horizon-cli netimport panorama --campaign=test --api-key=<api key> --hostname <panorama host>\n\nBy default, only the certificates deployed on the panorama (internal config and templates) will be scanned. If you wish to also scan each device managed by the panorama, use the --scan-devices option. If you do so, the Operational Requests permission must be added to the service account.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", - "keywords": ["import", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.16:introduction.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "Introduction", - "section": "introduction.html", - "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", - "breadcrumbs": ["Horizon Client", "Introduction"], - "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.16 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", - "keywords": ["introduction", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.16:release-notes:1.16.0", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "Horizon-cli 1.16.0 release notes", - "section": "release-notes", - "slug": "release-notes/1.16.0", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/release-notes/1.16.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/release-notes/1.16.0.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon-cli 1.16.0 release notes" - ], - "summary": "Horizon-cli 1.16.0 release notes Here are the release notes for EverTrust Horizon Client v1.16.0, released on 2026-04-13. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-9", - "content": "Horizon-cli 1.16.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.16.0, released on 2026-04-13.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-923] - All enrollment commands now support a --dn flag to specify the full Subject DN, enabling use of additional DN attributes such as DC.\n\n [HOR-939] - Ensured Windows Server 2025 support.\n\n [HOR-970] - Panorama discovery is now supported in the netimport section.\n\n [HOR-972] - Tenable.sc is now supported as a scan import source in the importscan section.\n\n [HOR-996] - A new --update flag is now available for protocol enrollment commands, allowing JKS and KDB keystores to be updated in place rather than overridden.\n\n [HOR-1019] - A new HRZ_LOCALDB environment variable is now supported to configure an alternative configuration directory.\n\n [HOR-1021] - A new horizon-cli automate edit command is now available to modify certificate options in the client internal state.\n\n [HOR-809] - A new --generic-windows-archival flag is now available on horizon-cli install to control whether outdated certificates are removed from the Windows store after renewal. This is to ensure compatibility with pre 1.11 versions.\n\n 2. Enhancements\n\n [HOR-1024] - horizon-cli automate list now displays certificates deleted outside the CLI as \"Could not retrieve\" instead of failing, and horizon-cli automate remove now supports removing such entries from state.\n\n [HOR-1140] - TLS ciphers reported by the NMAP ssl-enum-ciphers script are now parsed and displayed in Horizon scan results.\n\n [HOR-754] - IP SANs are now displayed alongside DNS SANs in horizon-cli automate list output.\n\n [HOR-78] - The --scan-tls flag is now available in netscan to test all TLS versions supported by an endpoint.\n\n 3. Bug Fixes\n\n [HOR-882] - Fixed an issue where EC certificates were not retrieved during an F5 netimport.\n\n [HOR-1017] - Fixed an issue where horizon-cli webra enroll returned unclear error messages when using a non-existent profile or a profile with a manual password policy.\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Horizon-cli 1.16.1 release notes", - "keywords": [ - "horizon-cli", - "16", - "release", - "notes", - "release-notes", - "release-notes/1", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.16:release-notes:1.16.1", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "Horizon-cli 1.16.1 release notes", - "section": "release-notes", - "slug": "release-notes/1.16.1", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/release-notes/1.16.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/release-notes/1.16.1.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon-cli 1.16.1 release notes" - ], - "summary": "Horizon-cli 1.16.1 release notes Here are the release notes for EverTrust Horizon-cli v1.16.1, released on 2026-04-30. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2.", - "content": "Horizon-cli 1.16.1 release notes\n\n Here are the release notes for EverTrust Horizon-cli v1.16.1, released on 2026-04-30.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-1234] - Amazon Linux is now supported for TLS services base OS detection.\n\n 3. Bug Fixes\n\n [HOR-1232] - Fixed an issue where the DNS-01 script ACME solver could not be resolved when using DNS-01 validation.\n\n [HOR-1183] - Fixed an issue where the --pfx-strength help output for the init , control , and enroll commands incorrectly listed \"normal\" instead of \"average\" as a possible value.\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon-cli 1.16.0 release notes", - "keywords": [ - "horizon-cli", - "16", - "release", - "notes", - "release-notes", - "release-notes/1", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.16:requirements.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "Requirements", - "section": "requirements.html", - "slug": "requirements.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", - "breadcrumbs": ["Horizon Client", "Requirements"], - "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", - "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit);\n\n Microsoft Windows Server 2025 (64-bit);\n\n Introduction\n General Configuration and Usage", - "keywords": ["requirements", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.16:scep.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "SCEP Certificate Lifecycle Operations", - "section": "scep.html", - "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", - "breadcrumbs": [ - "Horizon Client", - "SCEP Certificate Lifecycle Operations" - ], - "summary": "SCEP Certificate Lifecycle Operations The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode. Usage: horizon-cli scep [co", - "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Challenge password in decentralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the SCEP profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli scep enroll --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the SCEP profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the SCEP request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli scep enroll --challenge=<challenge> --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n horizon-cli scep enroll --profile=<profile> --challenge=<challenge> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Enrollment with lots of metadata and output as PKCS#12\n\n horizon-cli scep enroll \\\n --profile=<profile> \\\n --challenge=<challenge> \\\n --key-type=rsa-2048 \\\n --dn=CN=test.example.com,OU=it \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n Renewal with output as key and certificate\n\n horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --cert=/path/to/cert --key=/path/to/key\n\n EST Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", - "keywords": [ - "scep", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.16:update.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "Update operations", - "section": "update.html", - "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", - "breadcrumbs": ["Horizon Client", "Updating a certificate"], - "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", - "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", - "keywords": [ - "update", - "operations", - "html", - "horizon", - "client", - "updating", - "certificate" - ] - }, - { - "page_id": "horizon-cli:1.16:webra.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.16", - "title": "WebRA Certificate Lifecycle Operations", - "section": "webra.html", - "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", - "breadcrumbs": [ - "Horizon Client", - "WebRA Certificate Lifecycle Operations" - ], - "summary": "WebRA Certificate Lifecycle Operations The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation. WebRA operations validation Like SCEP and EST,", - "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n --ms-guid\n\n Requested Microsoft GUID. Single value\n\n --ms-sid\n\n Requested Microsoft SID. Single value\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Import\n\n The `webra import`command is designed to import a certificate and its key on a profile.\n\n Import parameters\n\n Table 11. WebRA import parameters\n\n Parameter\n\n Description\n\n --profile\n\n Existing profile on which to import\n\n Table 12. Metadata parameters\n\n Parameter\n\n Description\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --contact-email\n\n Contact email of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n --metadata\n\n Technical metadata of the imported certificate, in key:value form\n\n Input parameters\n\n These parameters define how to find the certificate to import. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 13. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to import (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to import if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to import\n\n --in-jks-pwd\n\n Password for the JKS file to import\n\n --in-jks-alias\n\n Alias for the certificate to import in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to import\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Revocation parameters\n\n Define how to revoke this certificate:\n\n Table 14. WebRA revocation parameters\n\n Parameter\n\n Description\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n Input parameters\n\n These parameters define how to find the certificate to revoke. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 15. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --in-jks-pwd\n\n Password for the JKS file to revoke\n\n --in-jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra enroll --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n horizon-cli webra enroll \\\n --profile=<profile> \\\n --dn=CN=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n after this command, run periodically:\n\n horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra renew --in-cert /path/to/old/cert --in-key /path/to/old/key --cert /path/to/cert --key /path/to/key --now\n\n Revocation of a certificate\n\n horizon-cli webra revoke --in-cert /path/to/cert --in-key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", - "keywords": [ - "webra", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.5:automation.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.5", - "title": "Automation", - "section": "automation.html", - "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.5/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", - "breadcrumbs": [ - "Horizon Client", - "Automatic TLS Certificate Installation" - ], - "summary": "Automation The Horizon Client can help you automate the installation of your TLS certificates. Helper commands are available for Microsoft IIS , Apache and Nginx . Note that the two latter commands only work on Linux. Microsoft IIS The auto", - "content": "Automation\n\n The Horizon Client can help you automate the installation of your TLS certificates.\nHelper commands are available for Microsoft IIS , Apache and Nginx . Note that the two latter commands only work on Linux.\n\n Microsoft IIS\n\n The automate command for Microsoft IIS will enroll or renew a certificate, store it in the Windows Machine Store using the software backend , and bind it to the specified host and port.\n\n horizon-cli automate iis --enroll=<challenge> --profile=myestprofile --dnsnames=www.example.com --bind-host www.example.com:443\n\n Apache\n\n The automate command for Apache works exactly the same as the est client, except that it will restart your Apache server after the certificate has been installed.\n\n To restart your server, the client will try to use the service command to restart the service named httpd if the client is run on a RHEL machine or apache2 if any other distribution is used.\n\n horizon-cli automate apache --enroll=<challenge> --profile=myestprofile --dnsnames=www.example.com --cert /etc/ssl/certs/apache.pem --key /etc/ssl/private/apache.key\n\n Nginx\n\n The automate command for Nginx works exactly the same as the est client, except that it will restart your Nginx server after the certificate has been installed.\n\n To restart your server, the client will try to use the service command to restart the service named nginx .\n\n horizon-cli automate nginx --enroll=<challenge> --profile=myestprofile --dnsnames=www.example.com --cert /etc/ssl/certs/nginx.pem --key /etc/ssl/private/nginx.key\n\n Bulk Operations", - "keywords": [ - "automation", - "html", - "horizon", - "client", - "automatic", - "tls", - "certificate", - "installation" - ] - }, - { - "page_id": "horizon-cli:1.5:bulk.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.5", - "title": "Bulk operations", - "section": "bulk.html", - "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.5/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", - "breadcrumbs": ["Horizon Client", "Bulk Operations"], - "summary": "Bulk operations The horizon client allow to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update the bulk update command allow update of certificate metadata en masse. The command takes a ", - "content": "Bulk operations\n\n The horizon client allow to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n the bulk update command allow update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team and the labels of the certificates.\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --label\n\n The label, in the forme key:value, to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --label \"mylabel:myvalue\"\n\n Bulk migrate\n\n The bulk migrate command allow certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata.\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --label\n\n The label, in the forme key:value, to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --label mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allow certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n EST Certificate Lifecycle Operations\n Automatic TLS Certificate Installation", - "keywords": ["bulk", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.5:config.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.5", - "title": "General Configuration and Usage", - "section": "config.html", - "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.5/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", - "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], - "summary": "General Configuration and Usage General parameters of Horizon Client are configured through a file placed in one of the following locations: /opt/horizon/etc/horizon-cli.conf /usr/local/etc/horizon-cli.conf [C|D]:\\ProgramData\\EverTrust\\Hori", - "content": "General Configuration and Usage\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n /opt/horizon/etc/horizon-cli.conf\n\n /usr/local/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n The configuration file is in JSON format and contains the following:\n\n {\n \"api_id\": \"API-ID\",\n \"api_key\": \"API-Key\",\n \"endpoint\": \"endpoint url. e.g. https://horizon-test.evertrust.fr\",\n \"debug\": true,\n \"timeout\": 2,\n \"proxy\": \"proxy. e.g. http://myproxy.corp.local:3128\",\n \"root_ca\": \"Root CA PEM Certificate(s).\"\n}\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n https_proxy\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n Finally, Horizon Client is designed to output informative messages on STDOUT and logs on STDERR. Thus, a typical command line to launch Horizon Client will look the following:\n\n horizon-cli <command> <parameters> 2>horizon-cli.log\n\n You can use the “--help” parameter to get online help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Introduction\n Discovery Operations", - "keywords": [ - "general", - "configuration", - "and", - "usage", - "config", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.5:discovery.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.5", - "title": "Discovery Operations", - "section": "discovery.html", - "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.5/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", - "breadcrumbs": ["Horizon Client", "Discovery Operations"], - "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", - "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n General Configuration and Usage\n Import operations", - "keywords": ["discovery", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.5:est.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.5", - "title": "EST Certificate Lifecycle Operations", - "section": "est.html", - "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.5/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", - "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], - "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported: Static and authorized user/password in decentralized mode Stat", - "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported:\n\n Static and authorized user/password in decentralized mode\n\n Static and authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Static and authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in \"authorized\" mode thus a static username and password can be provided to Horizon Client for enrollment. They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est --enroll=static --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to \"challenge\" mode. A request must then be made on Horizon in order to retrieve the one-time password \"challenge\" to be used to authenticate the EST request. No APIID nor APIKEY need to be set.\n\n horizon-cli est --enroll=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to \"x509\" mode. The client is then able to make a request to Horizon by authenticating with an existing certificate. This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n horizon-cli est --enroll=cert --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est --enroll=cert --profile=test ---win-store-auth --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR. The CSR is generated according to Data parameters , and the private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR. The CSR is generated according to Data parameters . The private key generated by Horizon Client is discarded. A random password is generated and inserted into the CSR. If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password. The retrieved private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n The random password generated has 16 characters, letters and numbers. If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n EST Renewal\n\n The certificate renewal is performed by using the “--renewal” parameter. It works the same way as the Certificate swap mode, except that:\n\n it is designed to renew a certificate already issued by Horizon on the same profile\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est --renew --profile=test --key=/path/to/key --cert=/path/to/cert [key and certificate parameters]\n\nhorizon-cli est --renew --profile=test ---win-store-auth --cn=TestCN [key and certificate parameters]\n\n Revocation\n\n The certificate revocation is performed using the “--revoke” parameter, and used the APIID and APIKEY provided in the general configuration to authenticate to Horizon.\nThis means the user identified by the APIID parameter must have revocation rights on the certificate to revoke.\n\n horizon-cli est --revoke --cert=/path/to/cert\n\n Data parameters\n\n These parameters are used to be inserted in the Certificate Signing Request sent to Horizon.\n\n Table 1. CSR data parameters\n\n Parameter\n Description\n\n --cn\n\n Requested subject Common Name, single value, and mandatory.\n\n --ou\n\n Requested subject OU . Can contain multiple values. Optional.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values. Optional.\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values. Optional.\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 2. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfxpwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --export-jks\n\n Path to export the certificate and private key as JKS. Optional, must be used along pfx/pfxpwd options as pfxpwd option is used to protect the JKS\n\n --jks-alias\n\n Alias of the private key entry within the JKS. Optional, only used with --export-jks\n\n --jks-key-password\n\n Password of the private key entry within the JKS. Optional, defaults to pfxpdw, only used with --export-jks\n\n Table 3. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est --enroll=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est --enroll=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/p12 --pfxpwd=<pkcs12_password>\n\n You need to specify --key and --cert options, because you will need key and cert separately later on to trigger renewal\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est --enroll=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --centralized\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est --enroll=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/p12 --pfxpwd=<pkcs12_password> --centralized\n\n You need to specify --key and --cert options, because you will need key and cert separately later on to trigger renewal\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est --enroll=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal, output as key and certificate\n\n horizon-cli est --renew --profile=<profile> --key=/path/to/key --cert=/path/to/cert\n\n Decentralized renewal using machine windows store\n\n horizon-cli est --renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n Bulk Operations", - "keywords": [ - "est", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.5:import.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.5", - "title": "Import Operations", - "section": "import.html", - "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.5/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", - "breadcrumbs": ["Horizon Client", "Import operations"], - "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --pfx-password=<PKCS#12 password>\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", - "keywords": ["import", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.5:introduction.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.5", - "title": "Introduction", - "section": "introduction.html", - "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.5/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", - "breadcrumbs": ["Horizon Client", "Introduction"], - "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n This document is specific to Horizon Client version 1.5 , which may be used with EverTrust Horizon 2.2.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery\n\n Certificate import\n\n Certificate lifecycle management\n\n General Configuration and Usage", - "keywords": ["introduction", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.6:acme.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "ACME Certificate Lifecycle Operations", - "section": "acme.html", - "slug": "acme.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/acme.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.8/acme.html", - "breadcrumbs": [ - "Horizon Client", - "ACME Certificate Lifecycle Operations" - ], - "summary": "ACME Certificate Lifecycle Operations ACME Enrollment The Horizon Client uses the LEGO ACME client under the hood to enroll certificates with Horizon. As per the ACME protocol, the client will need to prove its ownership of the domain name(", - "content": "ACME Certificate Lifecycle Operations\n\n ACME Enrollment\n\n The Horizon Client uses the LEGO ACME client under the hood to enroll certificates with Horizon. As per the ACME protocol, the client will need to prove its ownership of the domain name(s) it wants to enroll a certificate for. This is done either by HTTP, TLS-ALPN or DNS challenge. An email address is also needed to create an ACME account with Horizon in order to enroll certificates.\n\n Table 1. ACME Validation parameters\n\n Parameter\n Description\n\n --account\n\n Email of the account to use.\n\n --dns-names\n\n DNS names to enroll a certificate for.\n\n --http-01-port\n\n Port to use for http01 challenge. (Optional)\n\n --tls-alpn-01-port\n\n Port to use for tlsalpn01 challenge. (Optional)\n\n --dns-01-provider\n\n DNS provider name to use for dns01 challenge, from the list at https://go-acme.github.io/lego/dns#dns-providers\"\n\n ACME Account\n\n The ACME account is used to store the ACME account key, which is used to sign the ACME requests. All of this is taken care of by the ACME modules of Horizon and Horizon Client.\n\n Given the email from the --account CLI parameter, the client will create an ACME account with Horizon, and store it’s private key in the /var/db/acme/accounts/<email>.pem file relative to the Horizon Client data folder ( /opt/horizon on unix and C:\\ProgramData\\Horizon on Windows).\nIf such a file already exists, the client will use it instead of creating a new account.\n\n ACME validation\n\n The ACME protocol requires the client to prove its ownership of the domain name(s) it wants to enroll a certificate for. This is done either by HTTP, TLS-ALPN or DNS challenge.The order in which the client will try the validation methods is the following:\n\n TLS-ALPN challenge\n\n HTTP challenge\n\n DNS challenge\n\n The allowed challenge validation modes for a profile need to be configured in Horizon. If the profile does not allow a challenge validation mode, the client will not be able to enroll a certificate for it.\n\n DNS challenge\n\n Note that the DNS challenge requires the client to be able to update the DNS records of the domain name(s) it wants to enroll a certificate for. This is done by providing the proper credentials for the DNS provider specified in the --dns-01-provider CLI parameter. Each provider will have different needs, but the credentials will need to be provided as environment variables in every case. Please refer to the LEGO documentation for more details.\n\n ACME Renewal\n\n The acme renew command is designed to work similarly to the acme enroll command, but with a few differences:\n\n The following input parameters can be used to specify the certificate to renew:\n\n Table 2. ACME Renewal input certificate parameters\n\n Parameter\n Description\n\n --in-cert\n\n Path to the Certificate to renew (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the certificate to renew in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n ACME Revocation\n\n You can revoke an ACME enrolled certificate using the account that enrolled it. The acme revoke command will revoke the certificate specified by the --cert parameter with the reason specified by the --reason parameter.\n\n The revocation reason must be one of the following:\n\n unspecified\n\n keycompromise\n\n affiliationchanged\n\n superseded\n\n cessationofoperation\n\n cacompromise\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 3. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS\n\n --jks-pwd\n\n Password used to encrypt the JKS file specified in the --jks parameter\n\n --jks-alias\n\n Alias of the private key entry within the JKS\n\n --jks-key-pwd\n\n Password of the private key entry within the JKS\n\n Table 4. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for ACME enrollment in various context\n\n Enrollment with HTTP-01 validation, output as key and certificate\n\n horizon-cli acme enroll --profile=<profile> [email protected] --key=/path/to/key --cert=/path/to/cert --dnsnames=test.example.com,www.test.example.com --http-01-port=5002\n\n Enrollment with Cloudflare DNS-01 validation, output as PKCS#12\n\n [email protected] \\\nCLOUDFLARE_API_KEY=<apikey> \\\nhorizon-cli acme enroll \\\n [email protected] \\\n --profile=<profile> \\\n --dnsnames=test.example.com,www.test.example.com \\\n --pfx=/path/to/pkcs12 \\\n --pfxpwd=<pkcs12_password> \\\n --dns-01-provider=cloudflare\n\n Enrollment with TLS-ALPN-01 validation, output in machine windows store\n\n horizon-cli acme enroll --profile=<profile> [email protected] --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store --tls-alpn-01-port=5001\n\n Renewal with HTTP-01 or TLS-ALPN-01 validation, output as key and certificate\n\n horizon-cli acme renew --profile=<profile> --account [email protected] --in-cert /path/to/cert --out-key=/path/to/key --out-cert=/path/to/cert --tls-alpn-01-port=5001 --http-01-port=5002\n\n The Client will use either HTTP-01 or TLS-ALPN-01 validation, depending on the authorized validation modes in the profile configuration. If both are authorized, the Client will try them in this order .\n\n Revoking a certificate using the account that enrolled it\n\n horizon-cli acme revoke --profile=<profile> --account [email protected] --cert /path/to/cert\n\n EST Certificate Lifecycle Operations\n SCEP Certificate Lifecycle Operations", - "keywords": [ - "acme", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.6:automation.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "Automation", - "section": "automation.html", - "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", - "breadcrumbs": [ - "Horizon Client", - "Automatic TLS Certificate Installation" - ], - "summary": "Automation The Horizon Client can help you automate the installation of your TLS certificates. This page documents both the legacy automation module , as it was in the 1.5.x series, and the new automation module , which is available in the ", - "content": "Automation\n\n The Horizon Client can help you automate the installation of your TLS certificates. This page documents both the legacy automation module , as it was in the 1.5.x series, and the new automation module , which is available in the 1.6.x series.\n\n Legacy Automation\n\n The legacy automation is now deprecated. Please use the New Automation instead\n\n Microsoft IIS\n\n The automate command for Microsoft IIS will enroll or renew a certificate, store it in the Windows Machine Store using the software backend , and bind it to the specified host and port.\n\n horizon-cli automate iis --enroll=<challenge> --profile=myestprofile --dnsnames=www.example.com --bind-host www.example.com:443\n\n Apache\n\n The automate command for Apache works exactly the same as the est client, except that it will restart your Apache server after the certificate has been installed.\n\n To restart your server, the client will try to use the service command to restart the service named httpd if the client is run on a RHEL machine or apache2 if any other distribution is used.\n\n horizon-cli automate apache --enroll=<challenge> --profile=myestprofile --dnsnames=www.example.com --cert /etc/ssl/certs/apache.pem --key /etc/ssl/private/apache.key\n\n Nginx\n\n The automate command for Nginx works exactly the same as the est client, except that it will restart your Nginx server after the certificate has been installed.\n\n To restart your server, the client will try to use the service command to restart the service named nginx .\n\n horizon-cli automate nginx --enroll=<challenge> --profile=myestprofile --dnsnames=www.example.com --cert /etc/ssl/certs/nginx.pem --key /etc/ssl/private/nginx.key\n\n New Automation\n\n The automate enroll command is the entry point for the new automation module. The difference between the legacy and new automation module resides in the discovery of certificates on your machine, and on the automatic renewal.\n\n Automation policies\n\n The new automation module relies on automation policies to know how the certificates should be enrolled and renewed. Automation policies are configurable in the Horizon web app, contain an EST, SCEP or ACME profile and other options, like preferred enrollment CA and hash algorithm. For each automation operation, an automation policy needs to be specified using the --automation-policy parameter.\n\nEverTrust recommends using EST for most use cases of server automation.\n\nSCEP automation is not yet supported on windows servers.\n\n Discovery\n\n The new automation module will discover certificates on your machine by parsing your webserver’s or TLS service’s configuration files. Supported services are:\n\n apache\n\n nginx\n\n tomcat\n\n jboss wildfly\n\n lighttpd\n\n microsoft iis\n\n winhorizon\n\n horizon adcsconnector\n\n By default, the automate enroll command will try to search for all supported services. If you want to limit the search to a specific list of services, you can use the --target option.\n\n horizon-cli automate enroll --target=apache,nginx [...]\n\n The discovery of config files relies on the \"usual\" locations for the services configuration folder. If you have an \"unusual\" configuration folder for your service, you can use the --config-folder option to specify it. Note that it only works if you restrict the discovery to a single service.\n\n You can use the --analyze-only flag to only perform the discovery phase, print results and exit.\n\n Enrollment\n\n Once the discovery phase is done, you will be presented with a list of certificates that can be enrolled. You can then select the certificates you want to enroll, and enrollments will be performed according to the automation policy and it’s corresponding profile.\n\n For example, if your automation policy specifies an EST profile with challenge password validation, the client will enroll the certificate using the EST protocol, and you will be prompted for the challenge password.\n\n The enrollment is meant to be somewhat intelligent, in that it does not enroll certificates that are already known by Horizon and compliant to your automation policy. For example, if you have initially enrolled your web server’s certificate using the EST, SCEP or ACME client on the same profile, and you run the automate enroll command, the client will not try to enroll the certificate again, but will simply update its internal database with the new information. If you want to re-enroll the certificates anyway, you can use the --force-enroll option.\n\n Additional enrollment parameters\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter to specify your discovery campaign. It will use the APIID and APIKEY defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\nUpon enrollment, you can add additional metadata to the certificate using the following parameters:\n\n Table 1. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine. The installation process will depend on the services that use the certificate, and the storage backend that was used to store the certificate. For example, if the certificate was used by Tomcat and was stored as a PKCS#12 file, then this file will be overwritten, with the same password. The old PKCS#12 file will be backed up by the client.\n\n The impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference. Each time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed. Reasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task. You can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 . We found this to be a human-readable way of uniquely identifying a local certificate.\n\n You can choose the output format of the automate list command. By default it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database. This command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database. This way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file. The backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\n\n Interactivity\n\n Two options are available to control the interactivity of the automate enroll command:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n the --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=MyPolicy\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n hzn automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Bulk Operations", - "keywords": [ - "automation", - "html", - "horizon", - "client", - "automatic", - "tls", - "certificate", - "installation" - ] - }, - { - "page_id": "horizon-cli:1.6:bulk.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "Bulk operations", - "section": "bulk.html", - "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", - "breadcrumbs": ["Horizon Client", "Bulk Operations"], - "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", - "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", - "keywords": ["bulk", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.6:config.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "General Configuration and Usage", - "section": "config.html", - "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", - "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], - "summary": "General Configuration and Usage Command line installation Use the command below to install the client and generate interactively your configuration file: horizon-cli install The configuration file can also be created using command line para", - "content": "General Configuration and Usage\n\n Command line installation\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration content\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n /opt/horizon/etc/horizon-cli.conf\n\n /usr/local/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n The configuration file is in JSON format and contains the following:\n\n {\n \"api_id\": \"API-ID\",\n \"api_key\": \"API-Key\",\n \"endpoint\": \"endpoint url. e.g. https://horizon-test.evertrust.fr\",\n \"debug\": false,\n \"timeout\": 2,\n \"proxy\": \"proxy. e.g. http://myproxy.corp.local:3128\",\n \"root_ca\": \"Root CA PEM Certificate(s).\",\n \"log_file\": \"The log file of Horizon.\"\n}\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n https_proxy\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n You can use the “--help” parameter to get online help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Introduction\n Discovery Operations", - "keywords": [ - "general", - "configuration", - "and", - "usage", - "config", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.6:discovery.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "Discovery Operations", - "section": "discovery.html", - "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", - "breadcrumbs": ["Horizon Client", "Discovery Operations"], - "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", - "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n General Configuration and Usage\n Import operations", - "keywords": ["discovery", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.6:est.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "EST Certificate Lifecycle Operations", - "section": "est.html", - "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", - "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], - "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported: Static and authorized user/password in decentralized mode Stat", - "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported:\n\n Static and authorized user/password in decentralized mode\n\n Static and authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Static and authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in \"authorized\" mode thus a static username and password can be provided to Horizon Client for enrollment. They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --mode=static --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to \"challenge\" mode. A request must then be made on Horizon in order to retrieve the one-time password \"challenge\" to be used to authenticate the EST request. No APIID nor APIKEY need to be set.\n\n horizon-cli est enroll --mode=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to \"x509\" mode. The client is then able to make a request to Horizon by authenticating with an existing certificate. This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n horizon-cli est enroll --mode=cert --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --mode=cert --profile=test ---win-store-auth --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR. The CSR is generated according to Data parameters , and the private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR. The CSR is generated according to Data parameters . The private key generated by Horizon Client is discarded. A random password is generated and inserted into the CSR. If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password. The retrieved private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n The random password generated has 16 characters, letters and numbers. If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command. It works the same way as the Certificate swap mode, except that:\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew --key=/path/to/key --cert=/path/to/cert [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN --win-store-save [key and certificate parameters]\n\n Data parameters\n\n These parameters are used to be inserted in the Certificate Signing Request sent to Horizon in Enroll mode.\n\n Table 1. CSR data parameters\n\n Parameter\n Description\n\n --cn\n\n Requested subject Common Name, single value, and mandatory.\n\n --ou\n\n Requested subject OU . Can contain multiple values. Optional.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values. Optional.\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values. Optional.\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 2. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional, must be used along pfx/pfxpwd options as pfxpwd option is used to protect the JKS\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias of the private key entry within the JKS. Optional, only used with --jks\n\n --jks-alias-pwd\n\n Password of the private key entry within the JKS. Optional, defaults to pfxpwd, only used with --jks\n\n Table 3. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --mode=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --mode=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --mode=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --centralized\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --mode=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfxpwd=<pkcs12_password> --centralized\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --mode=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --key=/path/to/new/key --cert=/path/to/new/cert\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --key=/path/to/key --cert=/path/to/cert\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n ACME Certificate Lifecycle Operations", - "keywords": [ - "est", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.6:import.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "Import Operations", - "section": "import.html", - "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", - "breadcrumbs": ["Horizon Client", "Import operations"], - "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --pfx-password=<PKCS#12 password>\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", - "keywords": ["import", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.6:introduction.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "Introduction", - "section": "introduction.html", - "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", - "breadcrumbs": ["Horizon Client", "Introduction"], - "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n This document is specific to Horizon Client version 1.6 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery\n\n Certificate import\n\n Certificate lifecycle management\n\n General Configuration and Usage", - "keywords": ["introduction", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.6:scep.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "SCEP Certificate Lifecycle Operations", - "section": "scep.html", - "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", - "breadcrumbs": [ - "Horizon Client", - "SCEP Certificate Lifecycle Operations" - ], - "summary": "SCEP Certificate Lifecycle Operations The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode. Usage: horizon-cli scep [co", - "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Validation\n\n Get a SCEP challenge password from the Horizon web app or REST API. You can then provide it with the --challenge parameter to the enroll command.\n\n Content Parameters\n\n You can customize the contents of the CSR using the following parameters:\n\n Table 1. SCEP enrollment content parameters\n\n Parameter\n Description\n\n --profile\n\n SCEP Profile to use\n\n --challenge\n\n SCEP pre-validated request challenge\n\n --cert\n\n Path to the certificate file to be written\n\n --key\n\n Path to the key file to be written\n\n --cn\n\n Common Name of the certificate to request\n\n --ou\n\n Organizational Units of the certificate to request\n\n --dnsnames\n\n SAN DNS Names of the certificate to request\n\n --ip\n\n SAN IP Addresses of the certificate to request\n\n --emails\n\n SAN RFC822 Names of the certificate to request\n\n --contact-email\n\n Contact email\n\n --owner\n\n Certificate owner\n\n --team\n\n Certificate owning team\n\n --labels\n\n Labels, in the form key:value\n\n --ca-chain\n\n Path to write the CA Chain to be written, as a PEM Bundle\n\n --pfx\n\n Path to write the PKCS#12 output to be written\n\n --pfx-pwd\n\n Password for the PKCS#12 output\n\n --key-type\n\n Type and size of the key to generate (defaults to rsa-2048 )\n\n --script\n\n Bash or powershell script to execute upon enrollment completion\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --jks\n\n Path to write the JKS output to be written\n\n --jks-pwd\n\n Password for the JKS output\n\n --jks-alias\n\n Alias for the JKS output\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output\n\n --overwrite\n\n Overwrite existing files\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n The following input parameters can be used to specify the certificate to renew:\n\n Table 2. SCEP input certificate parameters\n\n Parameter\n Description\n\n --profile\n\n SCEP Profile to use\n\n --key-type\n\n Key type\n\n --contact-email\n\n Contact email\n\n --owner\n\n Certificate owner\n\n --team\n\n Certificate owning team\n\n --labels\n\n Labels, in the form key:value\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after renewal\n\n --in-cert\n\n Path to the Certificate to renew (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the certificate to renew in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --cert\n\n Path to the Certificate to save as a PEM file\n\n --key\n\n Path to the Key to save as a PEM file\n\n --ca-chain\n\n Path to the Chain to save as a PEM file\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --script\n\n Execute bash or powershell script upon enrollment or renewal completion\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Optional, renewal modeonly\n\n Output Parameters\n\n Choose how the created certificate and its associated private key are stored.\nThe following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 or JKS file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 3. Platform-independent output parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional\n\n --jks-pwd\n\n Password used to encrypt the JKS file specified in the --jks parameter\n\n --jks-alias\n\n Alias of the private key entry within the JKS\n\n --jks-key-pwd\n\n Password of the private key entry within the JKS\n\n Metadata parameters\n\n Each certificate enrolled via horizon must have a profile, specified with the --profile flag. You can add extra metadata according to your needs using the following parameters:\n\n Table 4. SCEP metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n horizon-cli scep enroll --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Enrollment with lots of metadata and output as PKCS#12\n\n horizon-cli scep enroll \\\n --profile=<profile> \\\n --key-type=ecdsa-p384 \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password> \\\n\n Renewal with output as key and certificate\n\n horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --key=/path/to/key --cert=/path/to/cert\n\n ACME Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", - "keywords": [ - "scep", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.6:update.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "Update operations", - "section": "update.html", - "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", - "breadcrumbs": ["Horizon Client", "Updating a certificate"], - "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. The update-cert command need the 'Update (pop)' c", - "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\nThe update-cert command need the 'Update (pop)' common configuration permission enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Input parameters\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the Certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries.\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various context\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --key=/path/to/key --cert=/path/to/cert --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", - "keywords": [ - "update", - "operations", - "html", - "horizon", - "client", - "updating", - "certificate" - ] - }, - { - "page_id": "horizon-cli:1.6:webra.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.6", - "title": "WebRA Certificate Lifecycle Operations", - "section": "webra.html", - "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.6/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", - "breadcrumbs": [ - "Horizon Client", - "WebRA Certificate Lifecycle Operations" - ], - "summary": "WebRA Certificate Lifecycle Operations The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation. WebRA operations validation Like SCEP and EST,", - "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n Content Parameters\n\n You can customize the contents of the CSR using the following parameters:\n\n Table 1. WebRA enrollment content parameters\n\n Parameter\n Description\n\n --profile\n\n WebRA Profile to use\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --contact-email\n\n Contact email\n\n --cn\n\n Common Name of the certificate to request\n\n --ou\n\n Organizational Units of the certificate to request\n\n --dnsnames\n\n SAN DNS Names of the certificate to request\n\n --ip\n\n SAN IP Addresses of the certificate to request\n\n --emails\n\n SAN RFC822 Names of the certificate to request\n\n --ms-guid\n\n SAN MS GUID of the certificate to request\n\n --ms-sid\n\n SAN MS SID of the certificate to request\n\n --key-type\n\n Select a key type for your enrollment other than the default one of the profile\n\n --owner\n\n Certificate owner\n\n --team\n\n Certificate owning team\n\n --labels\n\n Labels, in the form key:value\n\n --cert\n\n path to the cert file to be created\n\n --key\n\n path to the key file to be created\n\n --ca-chain\n\n Path to write the CA Chain to, as a PEM Bundle\n\n --pfx\n\n Path to write the PKCS#12 output to be created\n\n --pfx-pwd\n\n Password for the PKCS#12 output, mandatory if pfx is set\n\n --jks\n\n Path to write the JKS output to be created\n\n --jks-pwd\n\n Password for the JKS output, mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output, mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output, mandatory if --jks is set\n\n --overwrite\n\n Overwrite existing files\n\n --win-store-save\n\n [Windows Only] Triggers the use of Windows certificate store to save the certificate after enrollment\n\n --win-machine-store\n\n [Windows Only] Triggers the use of local machine store on Windows\n\n --win-use-tpm\n\n [Windows Only] Triggers the use of the Microsoft Platform Crypto Provider for certificate store save. Used only with win-store-save.\n\n --script\n\n Execute bash or powershell script upon enrollment or renewal completion\n\n --now\n\n If user has only \"request enroll\" permission, start a blocking loop until review, instead of waiting for the next routine execution\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n The following input parameters can be used to specify the certificate to renew:\n\n Table 2. WebRA input certificate parameters\n\n Parameter\n Description\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --in-cert\n\n Path to the Certificate to renew (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the certificate to renew in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --key-type\n\n The key type to use for the renewed certificate\n\n --cert\n\n Path to the cert file to be created\n\n --key\n\n Path to the key file to be created\n\n --ca-chain\n\n Path to write the CA Chain to, as a PEM Bundle\n\n --overwrite\n\n Overwrite existing files\n\n --pfx\n\n Path to write the PKCS#12 output to be created\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if pfx is set\n\n --jks\n\n Path to write the JKS output to be created\n\n --jks-pwd\n\n Password for the JKS output, mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output, mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output, mandatory if --jks is set\n\n --overwrite\n\n Overwrite existing files\n\n --win-store-save\n\n [Windows Only] Triggers the use of Windows certificate store to save the certificate after enrollment\n\n --win-machine-store\n\n [Windows Only] Triggers the use of local machine store on Windows\n\n --win-use-tpm\n\n [Windows Only] Triggers the use of the Microsoft Platform Crypto Provider for certificate store save. Used only with win-store-save.\n\n --script\n\n Execute bash or powershell script upon enrollment or renewal completion\n\n --now\n\n If user has only \"request enroll\" permission, start a blocking loop until review, instead of waiting for the next routine execution\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Optional, renewal mode only\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Table 3. WebRA revocation parameters\n\n Parameter\n Description\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --jks-pwd\n\n Password for the JKS file to revoke\n\n --jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Output Parameters\n\n Choose how the created certificate and its associated private key are stored.\nThe following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 or JKS file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 4. Platform-independent output parameters\n\n Parameter\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional\n\n --jks-pwd\n\n Password used to encrypt the JKS file specified in the --jks parameter\n\n --jks-alias\n\n Alias of the private key entry within the JKS\n\n --jks-key-pwd\n\n Password of the private key entry within the JKS\n\n Table 5. Windows-only output parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Metadata parameters\n\n Each certificate enrolled via horizon must have a profile, specified with the --profile flag. You can add extra metadata according to your needs using the following parameters:\n\n Table 6. SCEP metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra enroll --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n horizon-cli webra enroll \\\n --profile=<profile> \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfxpwd=<pkcs12_password> \\\n\n after this command, run periodically:\n\n horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra renew --in-key /path/to/old/key --in-cert /path/to/old/cert --key /path/to/key --cert /path/to/cert --now\n\n Revocation of a certificate\n\n horizon-cli webra revoke --in-cert /path/to/cert --in-key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", - "keywords": [ - "webra", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.7:acme.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "ACME Certificate Lifecycle Operations", - "section": "acme.html", - "slug": "acme.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/acme.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.8/acme.html", - "breadcrumbs": [ - "Horizon Client", - "ACME Certificate Lifecycle Operations" - ], - "summary": "ACME Certificate Lifecycle Operations ACME Enrollment The Horizon Client uses the LEGO ACME client under the hood to enroll certificates with Horizon. As per the ACME protocol, the client will need to prove its ownership of the domain name(", - "content": "ACME Certificate Lifecycle Operations\n\n ACME Enrollment\n\n The Horizon Client uses the LEGO ACME client under the hood to enroll certificates with Horizon. As per the ACME protocol, the client will need to prove its ownership of the domain name(s) it wants to enroll a certificate for. This is done either by HTTP, TLS-ALPN or DNS challenge. An email address is also needed to create an ACME account with Horizon in order to enroll certificates.\n\n Table 1. ACME Validation parameters\n\n Parameter\n Description\n\n --account\n\n Email of the account to use.\n\n --dns-names\n\n DNS names to enroll a certificate for.\n\n --http-01-port\n\n Port to use for http01 challenge. (Optional)\n\n --tls-alpn-01-port\n\n Port to use for tlsalpn01 challenge. (Optional)\n\n --dns-01-provider\n\n DNS provider name to use for dns01 challenge, from the list at https://go-acme.github.io/lego/dns#dns-providers\"\n\n ACME Account\n\n The ACME account is used to store the ACME account key, which is used to sign the ACME requests. All of this is taken care of by the ACME modules of Horizon and Horizon Client.\n\n Given the email from the --account CLI parameter, the client will create an ACME account with Horizon, and store it’s private key in the /var/db/acme/accounts/<email>.pem file relative to the Horizon Client data folder ( /opt/horizon on unix and C:\\ProgramData\\Horizon on Windows).\nIf such a file already exists, the client will use it instead of creating a new account.\n\n ACME validation\n\n The ACME protocol requires the client to prove its ownership of the domain name(s) it wants to enroll a certificate for. This is done either by HTTP, TLS-ALPN or DNS challenge.The order in which the client will try the validation methods is the following:\n\n TLS-ALPN challenge\n\n HTTP challenge\n\n DNS challenge\n\n The allowed challenge validation modes for a profile need to be configured in Horizon. If the profile does not allow a challenge validation mode, the client will not be able to enroll a certificate for it.\n\n DNS challenge\n\n Note that the DNS challenge requires the client to be able to update the DNS records of the domain name(s) it wants to enroll a certificate for. This is done by providing the proper credentials for the DNS provider specified in the --dns-01-provider CLI parameter. Each provider will have different needs, but the credentials will need to be provided as environment variables in every case. Please refer to the LEGO documentation for more details.\n\n ACME Renewal\n\n The acme renew command is designed to work similarly to the acme enroll command, but with a few differences:\n\n The following input parameters can be used to specify the certificate to renew:\n\n Table 2. ACME Renewal input certificate parameters\n\n Parameter\n Description\n\n --in-cert\n\n Path to the Certificate to renew (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the certificate to renew in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n ACME Revocation\n\n You can revoke an ACME enrolled certificate using the account that enrolled it. The acme revoke command will revoke the certificate specified by the --cert parameter with the reason specified by the --reason parameter.\n\n The revocation reason must be one of the following:\n\n unspecified\n\n keycompromise\n\n affiliationchanged\n\n superseded\n\n cessationofoperation\n\n cacompromise\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 3. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS\n\n --jks-pwd\n\n Password used to encrypt the JKS file specified in the --jks parameter\n\n --jks-alias\n\n Alias of the private key entry within the JKS\n\n Table 4. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for ACME enrollment in various context\n\n Enrollment with HTTP-01 validation, output as key and certificate\n\n # horizon-cli acme enroll --profile=<profile> [email protected] --key=/path/to/key --cert=/path/to/cert --dnsnames=test.example.com,www.test.example.com --http-01-port=5002\n\n Enrollment with Cloudflare DNS-01 validation, output as PKCS#12\n\n [email protected] \\\nCLOUDFLARE_API_KEY=<apikey> \\\nhorizon-cli acme enroll \\\n [email protected] \\\n --profile=<profile> \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password> \\\n --dns-01-provider=cloudflare\n\n Enrollment with TLS-ALPN-01 validation, output in machine windows store\n\n # horizon-cli acme enroll --profile=<profile> [email protected] --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store --tls-alpn-01-port=5001\n\n Renewal with HTTP-01 or TLS-ALPN-01 validation, output as key and certificate\n\n # horizon-cli acme renew --profile=<profile> --account [email protected] --in-cert /path/to/cert --out-key=/path/to/key --out-cert=/path/to/cert --tls-alpn-01-port=5001 --http-01-port=5002\n\n The Client will use either HTTP-01 or TLS-ALPN-01 validation, depending on the authorized validation modes in the profile configuration. If both are authorized, the Client will try them in this order .\n\n Revoking a certificate using the account that enrolled it\n\n # horizon-cli acme revoke --profile=<profile> --account [email protected] --in-cert /path/to/cert\n\n EST Certificate Lifecycle Operations\n SCEP Certificate Lifecycle Operations", - "keywords": [ - "acme", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.7:automation.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Automation", - "section": "automation.html", - "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", - "breadcrumbs": [ - "Horizon Client", - "Automatic TLS Certificate Installation" - ], - "summary": "Automation The Horizon Client can help you automate the installation of your TLS certificates. This page documents both the legacy automation module , as it was in the 1.5.x series, and the new automation module , which is available in the ", - "content": "Automation\n\n The Horizon Client can help you automate the installation of your TLS certificates. This page documents both the legacy automation module , as it was in the 1.5.x series, and the new automation module , which is available in the 1.6.x series.\n\n Legacy Automation\n\n The legacy automation is now deprecated. Please use the New Automation instead\n\n Microsoft IIS\n\n The automate command for Microsoft IIS will enroll or renew a certificate, store it in the Windows Machine Store using the software backend , and bind it to the specified host and port.\n\n # horizon-cli automate iis --enroll=<challenge> --profile=myestprofile --dnsnames=www.example.com --bind-host www.example.com:443\n\n Apache\n\n The automate command for Apache works exactly the same as the est client, except that it will restart your Apache server after the certificate has been installed.\n\n To restart your server, the client will try to use the service command to restart the service named httpd if the client is run on a RHEL machine or apache2 if any other distribution is used.\n\n # horizon-cli automate apache --enroll=<challenge> --profile=myestprofile --dnsnames=www.example.com --cert /etc/ssl/certs/apache.pem --key /etc/ssl/private/apache.key\n\n Nginx\n\n The automate command for Nginx works exactly the same as the est client, except that it will restart your Nginx server after the certificate has been installed.\n\n To restart your server, the client will try to use the service command to restart the service named nginx .\n\n # horizon-cli automate nginx --enroll=<challenge> --profile=myestprofile --dnsnames=www.example.com --cert /etc/ssl/certs/nginx.pem --key /etc/ssl/private/nginx.key\n\n New Automation\n\n The automate enroll command is the entry point for the new automation module. The difference between the legacy and new automation module resides in the discovery of certificates on your machine, and on the automatic renewal.\n\n Automation policies\n\n The new automation module relies on automation policies to know how the certificates should be enrolled and renewed. Automation policies are configurable in the Horizon web app, contain an EST, SCEP or ACME profile and other options, like preferred enrollment CA and hash algorithm. For each automation operation, an automation policy needs to be specified using the --automation-policy parameter.\n\nEverTrust recommends using EST for most use cases of server automation.\n\nSCEP automation is not yet supported on windows servers.\n\n Discovery\n\n The new automation module will discover certificates on your machine by parsing your webserver’s or TLS service’s configuration files. Supported services are:\n\n apache\n\n nginx\n\n tomcat\n\n jboss wildfly\n\n lighttpd\n\n microsoft iis\n\n winhorizon\n\n horizon adcsconnector\n\n By default, the automate enroll command will try to search for all supported services. If you want to limit the search to a specific list of services, you can use the --target option.\n\n # horizon-cli automate enroll --target=apache,nginx [...]\n\n The discovery of config files relies on the \"usual\" locations for the services configuration folder. If you have an \"unusual\" configuration folder for your service, you can use the --config-folder option to specify it. Note that it only works if you restrict the discovery to a single service.\n\n You can use the --analyze-only flag to only perform the discovery phase, print results and exit.\n\n Enrollment\n\n Once the discovery phase is done, you will be presented with a list of certificates that can be enrolled. You can then select the certificates you want to enroll, and enrollments will be performed according to the automation policy and it’s corresponding profile.\n\n For example, if your automation policy specifies an EST profile with challenge password validation, the client will enroll the certificate using the EST protocol, and you will be prompted for the challenge password.\n\n The enrollment is meant to be somewhat intelligent, in that it does not enroll certificates that are already known by Horizon and compliant to your automation policy. For example, if you have initially enrolled your web server’s certificate using the EST, SCEP or ACME client on the same profile, and you run the automate enroll command, the client will not try to enroll the certificate again, but will simply update its internal database with the new information. If you want to re-enroll the certificates anyway, you can use the --force-enroll option.\n\n Additional enrollment parameters\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery-campaign parameter to specify your discovery campaign. It will use the APIID and APIKEY defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\nUpon enrollment, you can add additional metadata to the certificate using the following parameters:\n\n Table 1. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n Table 2. Protocol specific parameters\n\n Parameter\n Description\n\n --acme-account\n\n Email of the acme account to use for enrollment\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine. The installation process will depend on the services that use the certificate, and the storage backend that was used to store the certificate. For example, if the certificate was used by Tomcat and was stored as a PKCS#12 file, then this file will be overwritten, with the same password. The old PKCS#12 file will be backed up by the client.\n\n The impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference. Each time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed. Reasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task. You can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 . We found this to be a human-readable way of uniquely identifying a local certificate.\n\n You can choose the output format of the automate list command. By default it outputs a string, but you can use the --json option to output a JSON object. example:\n\n # horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database. This command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database. This way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file. The backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client. For certificates stored in the windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n Interactivity\n\n Two options are available to control the interactivity of the automate enroll command:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n the --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n # horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=MyPolicy\n\n Use the interactive mode\n\n # horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n # horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n # horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n # horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n # horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.7.5 release notes", - "keywords": [ - "automation", - "html", - "horizon", - "client", - "automatic", - "tls", - "certificate", - "installation" - ] - }, - { - "page_id": "horizon-cli:1.7:bulk.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Bulk operations", - "section": "bulk.html", - "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", - "breadcrumbs": ["Horizon Client", "Bulk Operations"], - "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", - "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n --metadata\n\n The metadata to set on certificates matching the query. (Optional)\n\n # horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n --metadata\n\n The metadata to set on certificates matching the query. (Optional)\n\n # horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --reason\n\n Reason for revocation. Default is \"unspecified\"\n\n # horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", - "keywords": ["bulk", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.7:config.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "General Configuration and Usage", - "section": "config.html", - "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", - "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], - "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package # yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package # yum remove horizon-cli Using MSI file: To insta", - "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n # yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n # yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n # chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n # horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n # horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration content\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n /opt/horizon/etc/horizon-cli.conf\n\n /usr/local/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n The configuration file is in JSON format and contains the following:\n\n {\n \"api_id\": \"API-ID\",\n \"api_key\": \"API-Key\",\n \"endpoint\": \"endpoint url. e.g. https://horizon-test.evertrust.fr\",\n \"debug\": false,\n \"timeout\": 2,\n \"proxy\": \"proxy. e.g. http://myproxy.corp.local:3128\",\n \"root_ca\": \"Root CA PEM Certificate(s).\",\n \"log_file\": \"The log file of Horizon.\"\n}\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n https_proxy\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n # horizon-cli <command> <subcommand> --help\n\n Introduction\n Discovery Operations", - "keywords": [ - "general", - "configuration", - "and", - "usage", - "config", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.7:discovery.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Discovery Operations", - "section": "discovery.html", - "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", - "breadcrumbs": ["Horizon Client", "Discovery Operations"], - "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", - "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n # horizon-cli localscan --campaign=test\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n # horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n # horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n The created task can then be removed using:\n\n # horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n # horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n # horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n General Configuration and Usage\n Import operations", - "keywords": ["discovery", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.7:est.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "EST Certificate Lifecycle Operations", - "section": "est.html", - "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", - "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], - "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported: Static and authorized user/password in decentralized mode Stat", - "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported:\n\n Static and authorized user/password in decentralized mode\n\n Static and authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Static and authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in \"authorized\" mode thus a static username and password can be provided to Horizon Client for enrollment. They need to be set in general configuration as APIID and APIKEY .\n\n # horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to \"challenge\" mode. A request must then be made on Horizon in order to retrieve the one-time password \"challenge\" to be used to authenticate the EST request. No APIID nor APIKEY need to be set.\n\n # horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to \"x509\" mode. The client is then able to make a request to Horizon by authenticating with an existing certificate. This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n # horizon-cli est enroll --auth-cert --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\n# horizon-cli est enroll --auth-cert --profile=test ---win-store-auth --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR. The CSR is generated according to Data parameters , and the private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR. The CSR is generated according to Data parameters . The private key generated by Horizon Client is discarded. A random password is generated and inserted into the CSR. If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password. The retrieved private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n The random password generated has 16 characters, letters and numbers. If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command. It works the same way as the Certificate swap mode, except that:\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n # horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\n# horizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n Data parameters\n\n These parameters are used to be inserted in the Certificate Signing Request sent to Horizon in Enroll mode.\n\n Table 1. CSR data parameters\n\n Parameter\n Description\n\n --cn\n\n Requested subject Common Name, single value, and mandatory.\n\n --ou\n\n Requested subject OU . Can contain multiple values. Optional.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values. Optional.\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values. Optional.\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 2. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional, must be used along pfx/pfxpwd options as pfxpwd option is used to protect the JKS\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias of the private key entry within the JKS. Optional, only used with --jks\n\n --jks-alias-pwd\n\n Password of the private key entry within the JKS. Optional, defaults to pfxpwd, only used with --jks\n\n Table 3. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n # horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n # horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n # horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n # horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n # horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n # horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n # horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n # horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n ACME Certificate Lifecycle Operations", - "keywords": [ - "est", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.7:import.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Import Operations", - "section": "import.html", - "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", - "breadcrumbs": ["Horizon Client", "Import operations"], - "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n # horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n # horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n # horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n # horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n # horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n # horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n # horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n # horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", - "keywords": ["import", "operations", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.7:introduction.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Introduction", - "section": "introduction.html", - "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", - "breadcrumbs": ["Horizon Client", "Introduction"], - "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n This document is specific to Horizon Client version 1.7 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n General Configuration and Usage", - "keywords": ["introduction", "html", "horizon", "client"] - }, - { - "page_id": "horizon-cli:1.7:release-notes:1.7.0", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Horizon CLI 1.7.0 release notes", - "section": "release-notes", - "slug": "release-notes/1.7.0", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.0.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon CLI 1.7.0 release notes" - ], - "summary": "Horizon CLI 1.7.0 release notes Here are the release notes for EverTrust Horizon Client v1.7.0, released on 2023-08-11. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-184", - "content": "Horizon CLI 1.7.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.7.0, released on 2023-08-11.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-184] - localimport now supports a CSV source\n\n [HCL-178] - Add the Tomcat automation support on windows\n\n [HCL-169] - Automation asks for SANs on all protocols\n\n [HCL-172] - Automation ask for explicit permission before restoring a certificate that is used on multiple services\n\n [HCL-160] - Bulk revoke now supports a revocation reason parameter\n\n [HCL-181] - Localscan now scans Windows files\n\n [HCL-181] - Localscan now supports relative paths\n\n 2. Enhancements\n\n [HCL-181] - Localscan can read more configuration files\n\n [HCL-159] - Harmonize CLI flags across all supported protocols\n\n 3. Bug Fixes\n\n [HCL-177] - Automate enroll on an IIS server raised a CSP error\n\n [HCL-171] - Automate enroll through centralized EST didn’t work properly\n\n [HCL-179] - X509 Authentication on Horizon failed on Windows when used for EST operations\n\n 4. Known defects\n\n [HCL-229] - SCEP enrollments with key sizes equal or larger than 4096 will fail due to a third party bug in legacy encoding formats. We recommend customers who actively use this workflow to wait for a patch to be available.\n\n Horizon Cli 1.7.1 release notes", - "keywords": [ - "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.7:release-notes:1.7.1", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Horizon Cli 1.7.1 release notes", - "section": "release-notes", - "slug": "release-notes/1.7.1", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.1.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.7.1 release notes" - ], - "summary": "Horizon Cli 1.7.1 release notes Here are the release notes for EverTrust Horizon Client v1.7.1, released on 2023-08-24. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.7.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.7.1, released on 2023-08-24.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n Supporting a new crypto provider on Windows\n\n Supporting new CSPs/KSPs\n\n Improving the netscan speed (parallelized scans)\n\n 3. Bug Fixes\n\n [HCL-192] - Importing a CA on the Windows intermediate CA store could not work in some cases\n\n [HCL-191] - Bulk update operations were not compatible with the new metadata policies under some circumstances\n\n 4. Known defects\n\n [HCL-229] - SCEP enrollments with key sizes equal or larger than 4096 will fail due to a third party bug in legacy encoding formats. We recommend customers who actively use this workflow to wait for a patch to be available.\n\n Horizon Cli 1.7.2 release notes\n Horizon CLI 1.7.0 release notes", - "keywords": [ - "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.7:release-notes:1.7.2", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Horizon Cli 1.7.2 release notes", - "section": "release-notes", - "slug": "release-notes/1.7.2", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.2.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.2.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.7.2 release notes" - ], - "summary": "Horizon Cli 1.7.2 release notes Here are the release notes for EverTrust Horizon Client v1.7.2, released on 2023-09-14. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.7.2 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.7.2, released on 2023-09-14.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-203] - Adding ability to unset fields in the config file\n\n [HCL-204] - Adding contactEmail support on import\n\n 3. Bug Fixes\n\n [HCL-197] [HCL-200] [HCL-201] - Fixing IIS automation behaviour\n\n 4. Known defects\n\n [HCL-229] - SCEP enrollments with key sizes equal or larger than 4096 will fail due to a third party bug in legacy encoding formats. We recommend customers who actively use this workflow to wait for a patch to be available.\n\n Horizon Cli 1.7.3 release notes\n Horizon Cli 1.7.1 release notes", - "keywords": [ - "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.7:release-notes:1.7.3", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Horizon Cli 1.7.3 release notes", - "section": "release-notes", - "slug": "release-notes/1.7.3", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.3.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.3.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.7.3 release notes" - ], - "summary": "Horizon Cli 1.7.3 release notes Here are the release notes for EverTrust Horizon Client v1.7.3, released on 2023-10-09. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.7.3 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.7.3, released on 2023-10-09.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HCL-224] - Fixing automate iis renewal\n\n [HCL-225] - Fixing case sensitivity in DNS names comparison\n\n [HCL-217] - Fixing metadata automation policy that was not being set on EST challenge\n\n 4. Known defects\n\n [HCL-229] - SCEP enrollments with key sizes equal or larger than 4096 will fail due to a third party bug in legacy encoding formats. We recommend customers who actively use this workflow to wait for a patch to be available.\n\n Horizon Cli 1.7.4 release notes\n Horizon Cli 1.7.2 release notes", - "keywords": [ - "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.7:release-notes:1.7.4", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Horizon Cli 1.7.4 release notes", - "section": "release-notes", - "slug": "release-notes/1.7.4", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.4.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.4.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.7.4 release notes" - ], - "summary": "Horizon Cli 1.7.4 release notes Here are the release notes for EverTrust Horizon Client v1.7.4, released on 2023-10-17. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.7.4 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.7.4, released on 2023-10-17.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HCL-229] - Fixing a bug in third party encoding, now enabling SCEP enrollments for all key sizes\n\n [HCL-228] - Fixing IIS parsing in some edge cases resulting in an inability to detect ssl certificates\n\n [HCL-236] - Fixing a bug when unsetting values in install command\n\n [HCL-237] - Fixing a bug where revocation reason was not sent in webra revoke\n\n 4. Known defects\n\n [None]\n\n Horizon Cli 1.7.5 release notes\n Horizon Cli 1.7.3 release notes", - "keywords": [ - "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.7:release-notes:1.7.5", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.7", - "title": "Horizon Cli 1.7.5 release notes", - "section": "release-notes", - "slug": "release-notes/1.7.5", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.5.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.7/release-notes/1.7.5.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.7.5 release notes" - ], - "summary": "Horizon Cli 1.7.5 release notes Here are the release notes for EverTrust Horizon Client v1.7.5, released on 2023-11-28. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.7.5 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.7.5, released on 2023-11-28.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-261] - Improved error handling sent by Horizon server\n\n [HCL-258] - Added metadata editing on bulk update\n\n [HCL-255] - Added metadata editing on bulk migrate\n\n [HCL-242] - Windows log is now written in CRLF format instead of LF format\n\n [HCL-194] - Enabled winstore options with SCEP protocol\n\n [HCL-185] - Added key-type option with SCEP protocol\n\n 3. Bug Fixes\n\n [HCL-260] - Fixing a bug where a bulk migrate or a bulk update command failed to complete operation when query references the updated field\n\n 4. Known defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.7.4 release notes", - "keywords": [ - "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] + "slug": "requirements.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/requirements.html", + "breadcrumbs": ["Horizon Client", "Requirements"], + "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", + "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit);\n\n Introduction\n General Configuration and Usage", + "keywords": ["requirements", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.7:scep.html", + "page_id": "horizon-cli:1.15:scep.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.7", + "version": "1.15", "title": "SCEP Certificate Lifecycle Operations", "section": "scep.html", "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" ], - "summary": "SCEP Certificate Lifecycle Operations The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode. Usage: # horizon-cli scep [", - "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n # horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Validation\n\n Get a SCEP challenge password from the Horizon web app or REST API. You can then provide it with the --challenge parameter to the enroll command.\n\n Content Parameters\n\n You can customize the contents of the CSR using the following parameters:\n\n Table 1. SCEP enrollment content parameters\n\n Parameter\n Description\n\n --profile\n\n SCEP Profile to use\n\n --challenge\n\n SCEP pre-validated request challenge\n\n --cert\n\n Path to the certificate file to be written\n\n --key\n\n Path to the key file to be written\n\n --cn\n\n Common Name of the certificate to request\n\n --ou\n\n Organizational Units of the certificate to request\n\n --dnsnames\n\n SAN DNS Names of the certificate to request\n\n --ip\n\n SAN IP Addresses of the certificate to request\n\n --emails\n\n SAN RFC822 Names of the certificate to request\n\n --contact-email\n\n Contact email\n\n --owner\n\n Certificate owner\n\n --team\n\n Certificate owning team\n\n --labels\n\n Labels, in the form key:value\n\n --ca-chain\n\n Path to write the CA Chain to be written, as a PEM Bundle\n\n --pfx\n\n Path to write the PKCS#12 output to be written\n\n --pfx-pwd\n\n Password for the PKCS#12 output\n\n --key-type\n\n Type and size of the key to generate (defaults to rsa-2048 )\n\n --script\n\n Bash or powershell script to execute upon enrollment completion\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --jks\n\n Path to write the JKS output to be written\n\n --jks-pwd\n\n Password for the JKS output\n\n --jks-alias\n\n Alias for the JKS output\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output\n\n --overwrite\n\n Overwrite existing files\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n The following input parameters can be used to specify the certificate to renew:\n\n Table 2. SCEP input certificate parameters\n\n Parameter\n Description\n\n --profile\n\n SCEP Profile to use\n\n --key-type\n\n Key type\n\n --contact-email\n\n Contact email\n\n --owner\n\n Certificate owner\n\n --team\n\n Certificate owning team\n\n --labels\n\n Labels, in the form key:value\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after renewal\n\n --in-cert\n\n Path to the Certificate to renew (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the certificate to renew in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --cert\n\n Path to the Certificate to save as a PEM file\n\n --key\n\n Path to the Key to save as a PEM file\n\n --ca-chain\n\n Path to the Chain to save as a PEM file\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --script\n\n Execute bash or powershell script upon enrollment or renewal completion\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Optional, renewal modeonly\n\n Output Parameters\n\n Choose how the created certificate and its associated private key are stored.\nThe following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 or JKS file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 3. Platform-independent output parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional\n\n --jks-pwd\n\n Password used to encrypt the JKS file specified in the --jks parameter\n\n --jks-alias\n\n Alias of the private key entry within the JKS\n\n --jks-key-pwd\n\n Password of the private key entry within the JKS\n\n Table 4. Windows-only output parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Metadata parameters\n\n Each certificate enrolled via horizon must have a profile, specified with the --profile flag. You can add extra metadata according to your needs using the following parameters:\n\n Table 5. SCEP metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n # horizon-cli scep enroll --profile=<profile> --challenge=<challenge> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Enrollment with lots of metadata and output as PKCS#12\n\n # horizon-cli scep enroll \\\n --profile=<profile> \\\n --challenge=<challenge> \\\n --key-type=rsa-2048 \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n Renewal with output as key and certificate\n\n # horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --cert=/path/to/cert --key=/path/to/key\n\n ACME Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", + "summary": "SCEP Certificate Lifecycle Operations The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode. Usage: horizon-cli scep [co", + "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Challenge password in decentralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the SCEP profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli scep enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the SCEP profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the SCEP request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli scep enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n horizon-cli scep enroll --profile=<profile> --challenge=<challenge> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Enrollment with lots of metadata and output as PKCS#12\n\n horizon-cli scep enroll \\\n --profile=<profile> \\\n --challenge=<challenge> \\\n --key-type=rsa-2048 \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n Renewal with output as key and certificate\n\n horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --cert=/path/to/cert --key=/path/to/key\n\n EST Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", "keywords": [ "scep", "certificate", @@ -3645,19 +2168,19 @@ ] }, { - "page_id": "horizon-cli:1.7:update.html", + "page_id": "horizon-cli:1.15:update.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.7", + "version": "1.15", "title": "Update operations", "section": "update.html", "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], - "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. The update-cert command need the 'Update (pop)' c", - "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\nThe update-cert command need the 'Update (pop)' common configuration permission enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Input parameters\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the Certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries.\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various context\n\n Updating the owner of a certificate\n\n # horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n # horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n # horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", + "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", + "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", "keywords": [ "update", "operations", @@ -3669,22 +2192,22 @@ ] }, { - "page_id": "horizon-cli:1.7:webra.html", + "page_id": "horizon-cli:1.15:webra.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.7", + "version": "1.15", "title": "WebRA Certificate Lifecycle Operations", "section": "webra.html", "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.7/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" ], "summary": "WebRA Certificate Lifecycle Operations The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation. WebRA operations validation Like SCEP and EST,", - "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n Content Parameters\n\n You can customize the contents of the CSR using the following parameters:\n\n Table 1. WebRA enrollment content parameters\n\n Parameter\n Description\n\n --profile\n\n WebRA Profile to use\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --contact-email\n\n Contact email\n\n --cn\n\n Common Name of the certificate to request\n\n --ou\n\n Organizational Units of the certificate to request\n\n --dnsnames\n\n SAN DNS Names of the certificate to request\n\n --ip\n\n SAN IP Addresses of the certificate to request\n\n --emails\n\n SAN RFC822 Names of the certificate to request\n\n --ms-guid\n\n SAN MS GUID of the certificate to request\n\n --ms-sid\n\n SAN MS SID of the certificate to request\n\n --key-type\n\n Select a key type for your enrollment other than the default one of the profile\n\n --owner\n\n Certificate owner\n\n --team\n\n Certificate owning team\n\n --labels\n\n Labels, in the form key:value\n\n --cert\n\n path to the cert file to be created\n\n --key\n\n path to the key file to be created\n\n --ca-chain\n\n Path to write the CA Chain to, as a PEM Bundle\n\n --pfx\n\n Path to write the PKCS#12 output to be created\n\n --pfx-pwd\n\n Password for the PKCS#12 output, mandatory if pfx is set\n\n --jks\n\n Path to write the JKS output to be created\n\n --jks-pwd\n\n Password for the JKS output, mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output, mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output, mandatory if --jks is set\n\n --overwrite\n\n Overwrite existing files\n\n --win-store-save\n\n [Windows Only] Triggers the use of Windows certificate store to save the certificate after enrollment\n\n --win-machine-store\n\n [Windows Only] Triggers the use of local machine store on Windows\n\n --win-use-tpm\n\n [Windows Only] Triggers the use of the Microsoft Platform Crypto Provider for certificate store save. Used only with win-store-save.\n\n --script\n\n Execute bash or powershell script upon enrollment or renewal completion\n\n --now\n\n If user has only \"request enroll\" permission, start a blocking loop until review, instead of waiting for the next routine execution\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n The following input parameters can be used to specify the certificate to renew:\n\n Table 2. WebRA input certificate parameters\n\n Parameter\n Description\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --in-cert\n\n Path to the Certificate to renew (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the certificate to renew in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --key-type\n\n The key type to use for the renewed certificate\n\n --cert\n\n Path to the cert file to be created\n\n --key\n\n Path to the key file to be created\n\n --ca-chain\n\n Path to write the CA Chain to, as a PEM Bundle\n\n --overwrite\n\n Overwrite existing files\n\n --pfx\n\n Path to write the PKCS#12 output to be created\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if pfx is set\n\n --jks\n\n Path to write the JKS output to be created\n\n --jks-pwd\n\n Password for the JKS output, mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output, mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output, mandatory if --jks is set\n\n --overwrite\n\n Overwrite existing files\n\n --win-store-save\n\n [Windows Only] Triggers the use of Windows certificate store to save the certificate after enrollment\n\n --win-machine-store\n\n [Windows Only] Triggers the use of local machine store on Windows\n\n --win-use-tpm\n\n [Windows Only] Triggers the use of the Microsoft Platform Crypto Provider for certificate store save. Used only with win-store-save.\n\n --script\n\n Execute bash or powershell script upon enrollment or renewal completion\n\n --now\n\n If user has only \"request enroll\" permission, start a blocking loop until review, instead of waiting for the next routine execution\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Optional, renewal mode only\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Table 3. WebRA revocation parameters\n\n Parameter\n Description\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --jks-pwd\n\n Password for the JKS file to revoke\n\n --jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Output Parameters\n\n Choose how the created certificate and its associated private key are stored.\nThe following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 or JKS file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 4. Platform-independent output parameters\n\n Parameter\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional\n\n --jks-pwd\n\n Password used to encrypt the JKS file specified in the --jks parameter\n\n --jks-alias\n\n Alias of the private key entry within the JKS\n\n --jks-key-pwd\n\n Password of the private key entry within the JKS\n\n Table 5. Windows-only output parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Metadata parameters\n\n Each certificate enrolled via horizon must have a profile, specified with the --profile flag. You can add extra metadata according to your needs using the following parameters:\n\n Table 6. SCEP metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n # horizon-cli webra enroll --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n # horizon-cli webra enroll \\\n --profile=<profile> \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n after this command, run periodically:\n\n # horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n # horizon-cli webra renew --in-cert /path/to/old/cert --in-key /path/to/old/key --cert /path/to/cert --key /path/to/key --now\n\n Revocation of a certificate\n\n # horizon-cli webra revoke --in-cert /path/to/cert --in-key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", + "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n --ms-guid\n\n Requested Microsoft GUID. Single value\n\n --ms-sid\n\n Requested Microsoft SID. Single value\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Import\n\n The `webra import`command is designed to import a certificate and its key on a profile.\n\n Import parameters\n\n Table 11. WebRA import parameters\n\n Parameter\n\n Description\n\n --profile\n\n Existing profile on which to import\n\n Table 12. Metadata parameters\n\n Parameter\n\n Description\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --contact-email\n\n Contact email of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n --metadata\n\n Technical metadata of the imported certificate, in key:value form\n\n Input parameters\n\n These parameters define how to find the certificate to import. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 13. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to import (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to import if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to import\n\n --in-jks-pwd\n\n Password for the JKS file to import\n\n --in-jks-alias\n\n Alias for the certificate to import in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to import\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Revocation parameters\n\n Define how to revoke this certificate:\n\n Table 14. WebRA revocation parameters\n\n Parameter\n\n Description\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n Input parameters\n\n These parameters define how to find the certificate to revoke. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 15. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --in-jks-pwd\n\n Password for the JKS file to revoke\n\n --in-jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra enroll --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n horizon-cli webra enroll \\\n --profile=<profile> \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n after this command, run periodically:\n\n horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra renew --in-cert /path/to/old/cert --in-key /path/to/old/key --cert /path/to/cert --key /path/to/key --now\n\n Revocation of a certificate\n\n horizon-cli webra revoke --in-cert /path/to/cert --in-key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", "keywords": [ "webra", "certificate", @@ -3696,49 +2219,22 @@ ] }, { - "page_id": "horizon-cli:1.8:acme.html", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.8", - "title": "ACME Certificate Lifecycle Operations", - "section": "acme.html", - "slug": "acme.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/acme.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.8/acme.html", - "breadcrumbs": [ - "Horizon Client", - "ACME Certificate Lifecycle Operations" - ], - "summary": "ACME Certificate Lifecycle Operations ACME Enrollment The Horizon Client uses the LEGO ACME client under the hood to enroll certificates with Horizon. As per the ACME protocol, the client will need to prove its ownership of the domain name(", - "content": "ACME Certificate Lifecycle Operations\n\n ACME Enrollment\n\n The Horizon Client uses the LEGO ACME client under the hood to enroll certificates with Horizon. As per the ACME protocol, the client will need to prove its ownership of the domain name(s) it wants to enroll a certificate for. This is done either by HTTP, TLS-ALPN or DNS challenge. An email address is also needed to create an ACME account with Horizon in order to enroll certificates.\n\n Table 1. ACME Validation parameters\n\n Parameter\n Description\n\n --account\n\n Email of the account to use.\n\n --dns-names\n\n DNS names to enroll a certificate for.\n\n --http-01-port\n\n Port to use for http01 challenge. (Optional)\n\n --tls-alpn-01-port\n\n Port to use for tlsalpn01 challenge. (Optional)\n\n --dns-01-provider\n\n DNS provider name to use for dns01 challenge, from the LEGO supported list\n\n ACME Account\n\n The ACME account is used to store the ACME account key, which is used to sign the ACME requests. All of this is taken care of by the ACME modules of Horizon and Horizon Client.\n\n Given the email from the --account CLI parameter, the client will create an ACME account with Horizon, and store it’s private key in the /var/db/acme/accounts/<email>.pem file relative to the Horizon Client data folder ( /opt/horizon on unix and C:\\ProgramData\\Horizon on Windows).\nIf such a file already exists, the client will use it instead of creating a new account.\n\n ACME validation\n\n The ACME protocol requires the client to prove its ownership of the domain name(s) it wants to enroll a certificate for. This is done either by HTTP, TLS-ALPN or DNS challenge.The order in which the client will try the validation methods is the following:\n\n TLS-ALPN challenge\n\n HTTP challenge\n\n DNS challenge\n\n The allowed challenge validation modes for a profile need to be configured in Horizon. If the profile does not allow a challenge validation mode, the client will not be able to enroll a certificate for it.\n\n DNS challenge\n\n Note that the DNS challenge requires the client to be able to update the DNS records of the domain name(s) it wants to enroll a certificate for. This is done by providing the proper credentials for the DNS provider specified in the --dns-01-provider CLI parameter. Each provider will have different needs, but the credentials will need to be provided as environment variables in every case. Please refer to the LEGO documentation for more details.\n\n ACME Renewal\n\n The acme renew command is designed to work similarly to the acme enroll command, but with a few differences:\n\n The following input parameters can be used to specify the certificate to renew:\n\n Table 2. ACME Renewal input certificate parameters\n\n Parameter\n Description\n\n --in-cert\n\n Path to the Certificate to renew (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the certificate to renew in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n ACME Revocation\n\n You can revoke an ACME enrolled certificate using the account that enrolled it. The acme revoke command will revoke the certificate specified by the --cert parameter with the reason specified by the --reason parameter.\n\n The revocation reason must be one of the following:\n\n unspecified\n\n keycompromise\n\n affiliationchanged\n\n superseded\n\n cessationofoperation\n\n cacompromise\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 3. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS\n\n --jks-pwd\n\n Password used to encrypt the JKS file specified in the --jks parameter\n\n --jks-alias\n\n Alias of the private key entry within the JKS\n\n --jks-key-pwd\n\n Password of the private key entry within the JKS\n\n Table 4. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for ACME enrollment in various context\n\n Enrollment with HTTP-01 validation, output as key and certificate\n\n horizon-cli acme enroll --profile=<profile> [email protected] --key=/path/to/key --cert=/path/to/cert --dnsnames=test.example.com,www.test.example.com --http-01-port=5002\n\n Enrollment with Cloudflare DNS-01 validation, output as PKCS#12\n\n [email protected] \\\nCLOUDFLARE_API_KEY=<apikey> \\\nhorizon-cli acme enroll \\\n [email protected] \\\n --profile=<profile> \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password> \\\n --dns-01-provider=cloudflare\n\n Enrollment with TLS-ALPN-01 validation, output in machine windows store\n\n horizon-cli acme enroll --profile=<profile> [email protected] --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store --tls-alpn-01-port=5001\n\n Renewal with HTTP-01 or TLS-ALPN-01 validation, output as key and certificate\n\n horizon-cli acme renew --profile=<profile> --account [email protected] --in-cert /path/to/cert --out-key=/path/to/key --out-cert=/path/to/cert --tls-alpn-01-port=5001 --http-01-port=5002\n\n The Client will use either HTTP-01 or TLS-ALPN-01 validation, depending on the authorized validation modes in the profile configuration. If both are authorized, the Client will try them in this order .\n\n Revoking a certificate using the account that enrolled it\n\n horizon-cli acme revoke --profile=<profile> --account [email protected] --in-cert /path/to/cert\n\n EST Certificate Lifecycle Operations\n SCEP Certificate Lifecycle Operations", - "keywords": [ - "acme", - "certificate", - "lifecycle", - "operations", - "html", - "horizon", - "client" - ] - }, - { - "page_id": "horizon-cli:1.8:automation.html", + "page_id": "horizon-cli:1.16:automation.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", + "version": "1.16", "title": "Automation", "section": "automation.html", "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" ], "summary": "Automation The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly usef", - "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certs and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool.It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.This ensures a wide range of compatibility and flexibility for users working with different server environments.The --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n tomcat (Linux & Windows)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --machine-store : Save the certificate in the machine store. Ideal for certificates that must be available system-wide.\nThese options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.The impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option.Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.Each time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.Reasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.You can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate enroll command:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n the --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Table 7. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --user-store\n\n boolean\n\n Save the certificate in the windows user store.\n\n --machine-store\n\n boolean\n\n Save the certificate in the windows machine store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.See the other commands to match your use case.\n\n Parameters\n\n Table 8. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 9. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 10. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 11. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Table 12. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --user-store\n\n boolean\n\n Save the certificate in the windows user store.\n\n --machine-store\n\n boolean\n\n Save the certificate in the windows machine store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.If the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 13. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 14. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 15. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 16. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing.\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 17. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --machine-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --machine-store or --user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 18. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 19. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 20. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 21. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.By default it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.This command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.This way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.The backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.For certificates stored in the windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n Routine\n\n This command does not take any parameter.Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 22. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 23. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 24. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 25. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 26. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.8.1 release notes", + "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n edit\n\n This command allows the user to change values on the state of currently managed certificates.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, WebRA or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to control.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Table 27. Modify Generic options\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Edit\n\n The edit command allows to change automation data on managed certificates.\n\n Parameters\n\n Table 28. Edit selection parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --ids\n\n string array (comma separated)\n\n Identifiers of the services to edit. Supports glob syntax\n\n --serials\n\n string array (comma separated)\n\n Serial numbers of the certificates to edit all its services\n\n Table 29. Edit state parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --no-install\n\n boolean\n\n Change the no-install value for targeted services\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove --ids <id1>, …​, <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove --ids all command to remove all certificates from the local database.\n\n To select certificates to remove, another option is to use the --serials option with the serials of the certificates to remove.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 30. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 31. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 32. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 33. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 34. Remove parameters\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --ids\n\n string list\n\n Ids of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n --serials\n\n string list\n\n Serials of the certificates to remove. All linked services will be removed. See automate list to get the serial.\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove --ids all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove --ids nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove --ids nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove --ids nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore --ids tomcat-*:8443\n\n Bulk Operations\n Horizon-cli 1.16.1 release notes", "keywords": [ "automation", "html", @@ -3751,35 +2247,51 @@ ] }, { - "page_id": "horizon-cli:1.8:bulk.html", + "page_id": "horizon-cli:1.16:basic.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Basic commands", + "section": "basic.html", + "slug": "basic.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/basic.html", + "breadcrumbs": ["Horizon Client", "Basic commands"], + "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", + "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", + "keywords": ["basic", "commands", "html", "horizon", "client"] + }, + { + "page_id": "horizon-cli:1.16:bulk.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", + "version": "1.16", "title": "Bulk operations", "section": "bulk.html", "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", "keywords": ["bulk", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.8:config.html", + "page_id": "horizon-cli:1.16:config.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", + "version": "1.16", "title": "General Configuration and Usage", "section": "config.html", "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], - "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", - "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration content\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n /opt/horizon/etc/horizon-cli.conf\n\n /usr/local/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n The configuration file is in JSON format and contains the following:\n\n {\n \"api_id\": \"API-ID\",\n \"api_key\": \"API-Key\",\n \"endpoint\": \"endpoint url. e.g. https://horizon-test.evertrust.fr\",\n \"debug\": false,\n \"timeout\": 2,\n \"proxy\": \"proxy. e.g. http://myproxy.corp.local:3128\",\n \"root_ca\": \"Root CA PEM Certificate(s).\",\n \"log_file\": \"The log file of Horizon.\"\n}\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n https_proxy\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Introduction\n Discovery Operations", + "summary": "General Configuration and Usage Installation Package install/uninstall Installing the package RPM Windows Binary Installing from the Evertrust repository Create a /etc/yum.repos.d/horizon-cli.repo file containing the EverTrust repository in", + "content": "General Configuration and Usage\n\n Installation\n\n Package install/uninstall\n\n Installing the package\n\n RPM\n\n Windows\n\n Binary\n\n Installing from the Evertrust repository\n\n Create a /etc/yum.repos.d/horizon-cli.repo file containing the EverTrust repository info:\n\n [horizon-cli]\nenabled=1\nname=Horizon Client Repository\nbaseurl=https://repo.evertrust.io/repository/horizon-cli-rpm/\ngpgcheck=1\ngpgkey=https://evertrust.io/.well-known/rpm/gpg.pub\nusername=<username>\npassword=<password>\n\n Replace <username> and <password> with the credentials you were provided.\n\n Make sure the Evertrust GPG key is trusted:\n\n # rpm --import https://evertrust.io/.well-known/rpm/gpg.pub\n\n You can then run the following to install the latest Horizon Client version:\n\n # yum install horizon-cli\n\n To prevent unattended upgrades when running yum update, you should pin the Horizon Client version by adding\n\n exclude=horizon-cli\n\n at the end of the /etc/yum.repos.d/horizon-cli.repo file after installing Horizon Client.\n\n Installing from the package file\n\n Download the latest RPM for Horizon Client on the Official EVERTRUST repository .\n\n Upload the file ' horizon-cli-<latest>.x86_64.rpm ' to the server;\n\n Access the server with an account with administrative privileges;\n\n Install the Horizon Client package with the following command:\n\n # yum localinstall /root/horizon-cli-<latest>.x86_64.rpm\n\n If you wish to verify the signature of the RPM package, the EVERTRUST key can be added to your trusted keys using the following command:\n\n # rpm --import https://evertrust.io/.well-known/rpm/gpg.pub\n\n The signature can then be verified using the following command:\n\n # rpm -K /root/horizon-cli-<latest>.x86_64.rpm\n\n To install the package, double click on the MSI file and follow the instructions.\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the PATH , in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n # chmod +x horizon-cli.bin\n\n Uninstalling the package\n\n RPM\n\n Windows\n\n Binary\n\n # yum remove horizon-cli\n\n To uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Remove the binary file from your system, and remove it from PATH\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n $ horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n $ horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\n Configuration customization\n\n Changing the configuration file location\n\n In case you want to change the configuration file location, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\n Changing all horizon-client files location\n\n Additional files are used by the client (automation state, log files, etc). In case you want to change the path to these configurations, the HRZ_LOCAL_DATA environment variable can contain an absolute path to a folder, and will create all necessary files starting from this folder.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n $ horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", "keywords": [ "general", "configuration", @@ -3792,35 +2304,35 @@ ] }, { - "page_id": "horizon-cli:1.8:discovery.html", + "page_id": "horizon-cli:1.16:discovery.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", + "version": "1.16", "title": "Discovery Operations", "section": "discovery.html", "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", - "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n General Configuration and Usage\n Import operations", + "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Scanned folders\n\n By default, localscan will scan these commonly used paths:\n\n On Unix: /usr/local/etc , /etc and /opt\n\n On Windows: user store , machine store , program data , program files , program files x86\n\n To disable scanning these paths, use the --exclude-default-paths option.\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n If you wish to also scan the TLS versions and supported cipher suites of the scanned ports, you can use the --scan-supported-tls option.\n\n Due to technical limitations in the GO runtime, some cipher suites cannot be tested.\n\n The recommended approach is to import an nmap scan using nmap import .\n\n Supported cipher suites\n\n TLS_AES_128_GCM_SHA256\n\n TLS_AES_256_GCM_SHA384\n\n TLS_CHACHA20_POLY1305_SHA256\n\n TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA\n\n TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA\n\n TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\n\n TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\n\n TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\n\n TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\n\n TLS_RSA_WITH_RC4_128_SHA\n\n TLS_RSA_WITH_3DES_EDE_CBC_SHA\n\n TLS_RSA_WITH_AES_128_CBC_SHA\n\n TLS_RSA_WITH_AES_256_CBC_SHA\n\n TLS_RSA_WITH_AES_128_CBC_SHA256\n\n TLS_RSA_WITH_AES_128_GCM_SHA256\n\n TLS_RSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_ECDSA_WITH_RC4_128_SHA\n\n TLS_ECDHE_RSA_WITH_RC4_128_SHA\n\n TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256\n\n TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256\n\n Source : https://go.dev/src/crypto/tls/cipher_suites.go\n\n horizon-cli netscan --campaign=test --scan-supported-tls\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n If the ssl-enum-ciphers was also used on the scan, the TLS ciphers for the certificates will also be sent to Horizon.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into Horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Tenable.sc Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Tenable.sc into Horizon.\n\n To utilize this feature, you need to ensure that you have valid credentials for Tenable.sc with the necessary permissions to access and export scan data and the scan name on which you want to perform the import. Additionally, you must know your Tenable.sc hostname through which Horizon Client will communicate with the Tenable.sc API and use the \"SSL Certificate Information\" plugin output to get the certificates into Horizon.\n\n horizon-cli importscan tenable-sc --campaign=<campaign> --scan-name=<name of the scan> --hostname=<tenable.sc instance>\n\n Basic commands\n Import operations", "keywords": ["discovery", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.8:est.html", + "page_id": "horizon-cli:1.16:est.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", + "version": "1.16", "title": "EST Certificate Lifecycle Operations", "section": "est.html", "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], - "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported: Static and authorized user/password in decentralized mode Stat", - "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported:\n\n Static and authorized user/password in decentralized mode\n\n Static and authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Static and authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in \"authorized\" mode thus a static username and password can be provided to Horizon Client for enrollment. They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to \"challenge\" mode. A request must then be made on Horizon in order to retrieve the one-time password \"challenge\" to be used to authenticate the EST request. No APIID nor APIKEY need to be set.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to \"x509\" mode. The client is then able to make a request to Horizon by authenticating with an existing certificate. This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n horizon-cli est enroll --auth-cert --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --auth-cert --profile=test ---win-store-auth --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR. The CSR is generated according to Data parameters , and the private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR. The CSR is generated according to Data parameters . The private key generated by Horizon Client is discarded. A random password is generated and inserted into the CSR. If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password. The retrieved private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n The random password generated has 16 characters, letters and numbers. If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command. It works the same way as the Certificate swap mode, except that:\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n Data parameters\n\n These parameters are used to be inserted in the Certificate Signing Request sent to Horizon in Enroll mode.\n\n Table 1. CSR data parameters\n\n Parameter\n Description\n\n --cn\n\n Requested subject Common Name, single value, and mandatory.\n\n --ou\n\n Requested subject OU . Can contain multiple values. Optional.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values. Optional.\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values. Optional.\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 2. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional, must be used along pfx/pfxpwd options as pfxpwd option is used to protect the JKS\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias of the private key entry within the JKS. Optional, only used with --jks\n\n --jks-alias-pwd\n\n Password of the private key entry within the JKS. Optional, defaults to pfxpwd, only used with --jks\n\n Table 3. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n ACME Certificate Lifecycle Operations", + "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", + "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", "keywords": [ "est", "certificate", @@ -3832,110 +2344,128 @@ ] }, { - "page_id": "horizon-cli:1.8:import.html", + "page_id": "horizon-cli:1.16:import.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", + "version": "1.16", "title": "Import Operations", "section": "import.html", "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", + "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n --merge-third-party enables fine tracking of the certificate across multiple SSL profiles. Enable this flag only with Horizon version superior or equal to 2.7.18\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Nameshield\n\n You can import all your certificates from Nameshield certificates.\n\n horizon-cli netimport nameshield --campaign=test --token=<token>\n\n Panorama\n\n You can import all your certificates from PaloAlto Panorama.\n\n The required permissions for the scan operation are:\n\n XML API: Configuration\n\n horizon-cli netimport panorama --campaign=test --api-key=<api key> --hostname <panorama host>\n\nBy default, only the certificates deployed on the panorama (internal config and templates) will be scanned. If you wish to also scan each device managed by the panorama, use the --scan-devices option. If you do so, the Operational Requests permission must be added to the service account.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", "keywords": ["import", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.8:introduction.html", + "page_id": "horizon-cli:1.16:introduction.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", + "version": "1.16", "title": "Introduction", "section": "introduction.html", "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n This document is specific to Horizon Client version 1.8 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n General Configuration and Usage", + "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.16 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", "keywords": ["introduction", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.8:release-notes:1.8.0", + "page_id": "horizon-cli:1.16:release-notes:1.16.0", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", - "title": "Horizon Cli 1.8.0 release notes", + "version": "1.16", + "title": "Horizon-cli 1.16.0 release notes", "section": "release-notes", - "slug": "release-notes/1.8.0", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/release-notes/1.8.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.8/release-notes/1.8.0.html", + "slug": "release-notes/1.16.0", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/release-notes/1.16.0.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/release-notes/1.16.0.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.8.0 release notes" + "Horizon-cli 1.16.0 release notes" ], - "summary": "Horizon Cli 1.8.0 release notes Here are the release notes for EverTrust Horizon Client v1.8.0, released on 2024-01-09. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-227", - "content": "Horizon Cli 1.8.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.8.0, released on 2024-01-09.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-227] - Adding a generic automate driver eliminating the need to specify a pre-existing service or certificate file\n\n [HCL-270] - Adding an init command designed to automatically configure SSL on any newly installed web server\n\n [HCL-286] - Adding a control command designed to locate certificates within a web server’s configuration and offers to bring them under automation control\n\n [HCL-287] - Adding a modify command that allows the user to select one of the managed certs and modify its sans\n\n 2. Enhancements\n\n [HCL-289] - Add support for Nessus import\n\n [HCL-284] - Add ability to specify PKI metadata in CSV localimport\n\n [HCL-296] - Add an option on update-cert to update on Horizon\n\n 3. Bug Fixes\n\n [HCL-279] - Fix an error formatting issue on non JSON errors\n\n 4. Known defects\n\n [None]\n\n Horizon Cli 1.8.1 release notes", + "summary": "Horizon-cli 1.16.0 release notes Here are the release notes for EverTrust Horizon Client v1.16.0, released on 2026-04-13. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-9", + "content": "Horizon-cli 1.16.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.16.0, released on 2026-04-13.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-923] - All enrollment commands now support a --dn flag to specify the full Subject DN, enabling use of additional DN attributes such as DC.\n\n [HOR-939] - Ensured Windows Server 2025 support.\n\n [HOR-970] - Panorama discovery is now supported in the netimport section.\n\n [HOR-972] - Tenable.sc is now supported as a scan import source in the importscan section.\n\n [HOR-996] - A new --update flag is now available for protocol enrollment commands, allowing JKS and KDB keystores to be updated in place rather than overridden.\n\n [HOR-1019] - A new HRZ_LOCALDB environment variable is now supported to configure an alternative configuration directory.\n\n [HOR-1021] - A new horizon-cli automate edit command is now available to modify certificate options in the client internal state.\n\n [HOR-809] - A new --generic-windows-archival flag is now available on horizon-cli install to control whether outdated certificates are removed from the Windows store after renewal. This is to ensure compatibility with pre 1.11 versions.\n\n 2. Enhancements\n\n [HOR-1024] - horizon-cli automate list now displays certificates deleted outside the CLI as \"Could not retrieve\" instead of failing, and horizon-cli automate remove now supports removing such entries from state.\n\n [HOR-1140] - TLS ciphers reported by the NMAP ssl-enum-ciphers script are now parsed and displayed in Horizon scan results.\n\n [HOR-754] - IP SANs are now displayed alongside DNS SANs in horizon-cli automate list output.\n\n [HOR-78] - The --scan-tls flag is now available in netscan to test all TLS versions supported by an endpoint.\n\n 3. Bug Fixes\n\n [HOR-882] - Fixed an issue where EC certificates were not retrieved during an F5 netimport.\n\n [HOR-1017] - Fixed an issue where horizon-cli webra enroll returned unclear error messages when using a non-existent profile or a profile with a manual password policy.\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Horizon-cli 1.16.1 release notes", "keywords": [ - "horizon", - "cli", + "horizon-cli", + "16", "release", "notes", "release-notes", "release-notes/1", + "horizon", "client" ] }, { - "page_id": "horizon-cli:1.8:release-notes:1.8.1", + "page_id": "horizon-cli:1.16:release-notes:1.16.1", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", - "title": "Horizon Cli 1.8.1 release notes", + "version": "1.16", + "title": "Horizon-cli 1.16.1 release notes", "section": "release-notes", - "slug": "release-notes/1.8.1", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/release-notes/1.8.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.8/release-notes/1.8.1.html", + "slug": "release-notes/1.16.1", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/release-notes/1.16.1.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/release-notes/1.16.1.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.8.1 release notes" + "Horizon-cli 1.16.1 release notes" ], - "summary": "Horizon Cli 1.8.1 release notes Here are the release notes for EverTrust Horizon Client v1.8.1, released on 2024-01-23. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.8.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.8.1, released on 2024-01-23.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-307] - Add keystore-password option on automate commands to manually give keystore password\n\n [HCL-311] - Automate modify can now be used to modify post enrollment script path\n\n [HCL-312] - Generic automation can now be used with DER encoded certificates\n\n [HCL-306] - Remove useless custom user creation\n\n [HCL-305] - Improved Windows cryptographic providers support\n\n 3. Bug Fixes\n\n [HCL-308] - Netscan no longer sends duplicate certificates to Horizon\n\n [HCL-313] - Routine on ACME policy now properly functions\n\n 4. Known defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.8.0 release notes", + "summary": "Horizon-cli 1.16.1 release notes Here are the release notes for EverTrust Horizon-cli v1.16.1, released on 2026-04-30. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2.", + "content": "Horizon-cli 1.16.1 release notes\n\n Here are the release notes for EverTrust Horizon-cli v1.16.1, released on 2026-04-30.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-1234] - Amazon Linux is now supported for TLS services base OS detection.\n\n 3. Bug Fixes\n\n [HOR-1232] - Fixed an issue where the DNS-01 script ACME solver could not be resolved when using DNS-01 validation.\n\n [HOR-1183] - Fixed an issue where the --pfx-strength help output for the init , control , and enroll commands incorrectly listed \"normal\" instead of \"average\" as a possible value.\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon-cli 1.16.0 release notes", "keywords": [ - "horizon", - "cli", + "horizon-cli", + "16", "release", "notes", "release-notes", "release-notes/1", + "horizon", "client" ] }, { - "page_id": "horizon-cli:1.8:scep.html", + "page_id": "horizon-cli:1.16:requirements.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Requirements", + "section": "requirements.html", + "slug": "requirements.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/requirements.html", + "breadcrumbs": ["Horizon Client", "Requirements"], + "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", + "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit);\n\n Microsoft Windows Server 2025 (64-bit);\n\n Introduction\n General Configuration and Usage", + "keywords": ["requirements", "html", "horizon", "client"] + }, + { + "page_id": "horizon-cli:1.16:scep.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", + "version": "1.16", "title": "SCEP Certificate Lifecycle Operations", "section": "scep.html", "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" ], "summary": "SCEP Certificate Lifecycle Operations The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode. Usage: horizon-cli scep [co", - "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Validation\n\n Get a SCEP challenge password from the Horizon web app or REST API. You can then provide it with the --challenge parameter to the enroll command.\n\n Content Parameters\n\n You can customize the contents of the CSR using the following parameters:\n\n Table 1. SCEP enrollment content parameters\n\n Parameter\n Description\n\n --profile\n\n SCEP Profile to use\n\n --challenge\n\n SCEP pre-validated request challenge\n\n --cert\n\n Path to the certificate file to be written\n\n --key\n\n Path to the key file to be written\n\n --cn\n\n Common Name of the certificate to request\n\n --ou\n\n Organizational Units of the certificate to request\n\n --dnsnames\n\n SAN DNS Names of the certificate to request\n\n --ip\n\n SAN IP Addresses of the certificate to request\n\n --emails\n\n SAN RFC822 Names of the certificate to request\n\n --contact-email\n\n Contact email\n\n --owner\n\n Certificate owner\n\n --team\n\n Certificate owning team\n\n --labels\n\n Labels, in the form key:value\n\n --ca-chain\n\n Path to write the CA Chain to be written, as a PEM Bundle\n\n --pfx\n\n Path to write the PKCS#12 output to be written\n\n --pfx-pwd\n\n Password for the PKCS#12 output\n\n --key-type\n\n Type and size of the key to generate (defaults to rsa-2048 )\n\n --script\n\n Bash or powershell script to execute upon enrollment completion. See script section\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --jks\n\n Path to write the JKS output to be written\n\n --jks-pwd\n\n Password for the JKS output\n\n --jks-alias\n\n Alias for the JKS output\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output\n\n --overwrite\n\n Overwrite existing files\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n The following input parameters can be used to specify the certificate to renew:\n\n Table 2. SCEP input certificate parameters\n\n Parameter\n Description\n\n --profile\n\n SCEP Profile to use\n\n --key-type\n\n Key type\n\n --contact-email\n\n Contact email\n\n --owner\n\n Certificate owner\n\n --team\n\n Certificate owning team\n\n --labels\n\n Labels, in the form key:value\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after renewal\n\n --in-cert\n\n Path to the Certificate to renew (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the certificate to renew in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --cert\n\n Path to the Certificate to save as a PEM file\n\n --key\n\n Path to the Key to save as a PEM file\n\n --ca-chain\n\n Path to the Chain to save as a PEM file\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --script\n\n Execute bash or powershell script upon enrollment or renewal completion. See script section\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Optional, renewal modeonly\n\n Output Parameters\n\n Choose how the created certificate and its associated private key are stored.\nThe following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 or JKS file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 3. Platform-independent output parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional\n\n --jks-pwd\n\n Password used to encrypt the JKS file specified in the --jks parameter\n\n --jks-alias\n\n Alias of the private key entry within the JKS\n\n --jks-key-pwd\n\n Password of the private key entry within the JKS\n\n Metadata parameters\n\n Each certificate enrolled via horizon must have a profile, specified with the --profile flag. You can add extra metadata according to your needs using the following parameters:\n\n Table 4. SCEP metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n horizon-cli scep enroll --profile=<profile> --challenge=<challenge> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Enrollment with lots of metadata and output as PKCS#12\n\n horizon-cli scep enroll \\\n --profile=<profile> \\\n --challenge=<challenge> \\\n --key-type=rsa-2048 \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n Renewal with output as key and certificate\n\n horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --cert=/path/to/cert --key=/path/to/key\n\n ACME Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", + "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Challenge password in decentralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the SCEP profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli scep enroll --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the SCEP profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the SCEP request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli scep enroll --challenge=<challenge> --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n horizon-cli scep enroll --profile=<profile> --challenge=<challenge> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Enrollment with lots of metadata and output as PKCS#12\n\n horizon-cli scep enroll \\\n --profile=<profile> \\\n --challenge=<challenge> \\\n --key-type=rsa-2048 \\\n --dn=CN=test.example.com,OU=it \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n Renewal with output as key and certificate\n\n horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --cert=/path/to/cert --key=/path/to/key\n\n EST Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", "keywords": [ "scep", "certificate", @@ -3947,16 +2477,16 @@ ] }, { - "page_id": "horizon-cli:1.8:update.html", + "page_id": "horizon-cli:1.16:update.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", + "version": "1.16", "title": "Update operations", "section": "update.html", "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -3971,22 +2501,22 @@ ] }, { - "page_id": "horizon-cli:1.8:webra.html", + "page_id": "horizon-cli:1.16:webra.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.8", + "version": "1.16", "title": "WebRA Certificate Lifecycle Operations", "section": "webra.html", "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.8/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" ], "summary": "WebRA Certificate Lifecycle Operations The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation. WebRA operations validation Like SCEP and EST,", - "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n Content Parameters\n\n You can customize the contents of the CSR using the following parameters:\n\n Table 1. WebRA enrollment content parameters\n\n Parameter\n Description\n\n --profile\n\n WebRA Profile to use\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --contact-email\n\n Contact email\n\n --cn\n\n Common Name of the certificate to request\n\n --ou\n\n Organizational Units of the certificate to request\n\n --dnsnames\n\n SAN DNS Names of the certificate to request\n\n --ip\n\n SAN IP Addresses of the certificate to request\n\n --emails\n\n SAN RFC822 Names of the certificate to request\n\n --ms-guid\n\n SAN MS GUID of the certificate to request\n\n --ms-sid\n\n SAN MS SID of the certificate to request\n\n --key-type\n\n Select a key type for your enrollment other than the default one of the profile\n\n --owner\n\n Certificate owner\n\n --team\n\n Certificate owning team\n\n --labels\n\n Labels, in the form key:value\n\n --cert\n\n path to the cert file to be created\n\n --key\n\n path to the key file to be created\n\n --ca-chain\n\n Path to write the CA Chain to, as a PEM Bundle\n\n --pfx\n\n Path to write the PKCS#12 output to be created\n\n --pfx-pwd\n\n Password for the PKCS#12 output, mandatory if pfx is set\n\n --jks\n\n Path to write the JKS output to be created\n\n --jks-pwd\n\n Password for the JKS output, mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output, mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output, mandatory if --jks is set\n\n --overwrite\n\n Overwrite existing files\n\n --win-store-save\n\n [Windows Only] Triggers the use of Windows certificate store to save the certificate after enrollment\n\n --win-machine-store\n\n [Windows Only] Triggers the use of local machine store on Windows\n\n --win-use-tpm\n\n [Windows Only] Triggers the use of the Microsoft Platform Crypto Provider for certificate store save. Used only with win-store-save.\n\n --script\n\n Execute bash or powershell script upon enrollment or renewal completion. See script section\n\n --now\n\n If user has only \"request enroll\" permission, start a blocking loop until review, instead of waiting for the next routine execution\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n The following input parameters can be used to specify the certificate to renew:\n\n Table 2. WebRA input certificate parameters\n\n Parameter\n Description\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --in-cert\n\n Path to the Certificate to renew (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the certificate to renew in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --key-type\n\n The key type to use for the renewed certificate\n\n --cert\n\n Path to the cert file to be created\n\n --key\n\n Path to the key file to be created\n\n --ca-chain\n\n Path to write the CA Chain to, as a PEM Bundle\n\n --overwrite\n\n Overwrite existing files\n\n --pfx\n\n Path to write the PKCS#12 output to be created\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if pfx is set\n\n --jks\n\n Path to write the JKS output to be created\n\n --jks-pwd\n\n Password for the JKS output, mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output, mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output, mandatory if --jks is set\n\n --overwrite\n\n Overwrite existing files\n\n --win-store-save\n\n [Windows Only] Triggers the use of Windows certificate store to save the certificate after enrollment\n\n --win-machine-store\n\n [Windows Only] Triggers the use of local machine store on Windows\n\n --win-use-tpm\n\n [Windows Only] Triggers the use of the Microsoft Platform Crypto Provider for certificate store save. Used only with win-store-save.\n\n --script\n\n Execute bash or powershell script upon enrollment or renewal completion. See script section\n\n --now\n\n If user has only \"request enroll\" permission, start a blocking loop until review, instead of waiting for the next routine execution\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Optional, renewal mode only\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Table 3. WebRA revocation parameters\n\n Parameter\n Description\n\n --discovery\n\n Discovery profile to use in order to report the certificate to Horizon after enrollment\n\n --cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --jks-pwd\n\n Password for the JKS file to revoke\n\n --jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Output Parameters\n\n Choose how the created certificate and its associated private key are stored.\nThe following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 or JKS file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 4. Platform-independent output parameters\n\n Parameter\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional\n\n --jks-pwd\n\n Password used to encrypt the JKS file specified in the --jks parameter\n\n --jks-alias\n\n Alias of the private key entry within the JKS\n\n --jks-key-pwd\n\n Password of the private key entry within the JKS\n\n Table 5. Windows-only output parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Metadata parameters\n\n Each certificate enrolled via horizon must have a profile, specified with the --profile flag. You can add extra metadata according to your needs using the following parameters:\n\n Table 6. SCEP metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra enroll --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n horizon-cli webra enroll \\\n --profile=<profile> \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n after this command, run periodically:\n\n horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra renew --in-cert /path/to/old/cert --in-key /path/to/old/key --cert /path/to/cert --key /path/to/key --now\n\n Revocation of a certificate\n\n horizon-cli webra revoke --cert /path/to/cert --key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", + "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n --ms-guid\n\n Requested Microsoft GUID. Single value\n\n --ms-sid\n\n Requested Microsoft SID. Single value\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Import\n\n The `webra import`command is designed to import a certificate and its key on a profile.\n\n Import parameters\n\n Table 11. WebRA import parameters\n\n Parameter\n\n Description\n\n --profile\n\n Existing profile on which to import\n\n Table 12. Metadata parameters\n\n Parameter\n\n Description\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --contact-email\n\n Contact email of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n --metadata\n\n Technical metadata of the imported certificate, in key:value form\n\n Input parameters\n\n These parameters define how to find the certificate to import. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 13. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to import (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to import if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to import\n\n --in-jks-pwd\n\n Password for the JKS file to import\n\n --in-jks-alias\n\n Alias for the certificate to import in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to import\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Revocation parameters\n\n Define how to revoke this certificate:\n\n Table 14. WebRA revocation parameters\n\n Parameter\n\n Description\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n Input parameters\n\n These parameters define how to find the certificate to revoke. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 15. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --in-jks-pwd\n\n Password for the JKS file to revoke\n\n --in-jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra enroll --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n horizon-cli webra enroll \\\n --profile=<profile> \\\n --dn=CN=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n after this command, run periodically:\n\n horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra renew --in-cert /path/to/old/cert --in-key /path/to/old/key --cert /path/to/cert --key /path/to/key --now\n\n Revocation of a certificate\n\n horizon-cli webra revoke --in-cert /path/to/cert --in-key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", "keywords": [ "webra", "certificate", @@ -3998,22 +2528,22 @@ ] }, { - "page_id": "horizon-cli:1.9:automation.html", + "page_id": "horizon-cli:1.17:automation.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", + "version": "1.17", "title": "Automation", "section": "automation.html", "slug": "automation.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" ], "summary": "Automation The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly usef", - "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certs and modify its sans.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n tomcat (Linux & Windows)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate enroll command:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n the --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 9. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 10. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 11. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 12. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 13. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 14. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 15. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 16. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 17. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 18. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 19. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 20. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 21. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 22. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 23. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove <id1> …​ <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove all command to remove all certificates from the local database.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n Routine\n\n This command does not take any parameter.\nIts usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 24. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 25. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 26. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 27. Remove arguments\n\n Argument\n Mandatory\n Type\n Description\n\n id\n\n string\n\n Id of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n Table 28. Remove parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove nginx-*:443 --restore\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore tomcat-*:8443\n\n Bulk Operations\n Horizon Cli 1.9.5 release notes", + "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n edit\n\n This command allows the user to change values on the state of currently managed certificates.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, WebRA or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n ACME DNS-01 propagation tuning\n\n When solving an ACME DNS-01 challenge, horizon-cli runs an authoritative name server propagation pre-check against the DNS provider before notifying the ACME server. In private DNS environments (for example, AWS Route 53 private hosted zones or split-horizon DNS deployments), the public authoritative name servers exposed by the zone do not serve the private records, and the pre-check fails even though the ACME server-side validation would succeed.\n\n Two options on the enroll , init and control commands allow tuning this behavior:\n\n --dns-01-propagation-wait (duration): skips the client-side authoritative name server pre-check and instead waits the configured duration for the DNS record to propagate before notifying the ACME server. The ACME server-side validation is unaffected.\n\n --dns-01-timeout (duration): sets the overall DNS-01 operation timeout, which sizes the propagation wait loop.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --acme-account=<ACME_ACCOUNT> --dns-01-provider=<PROVIDER_SCRIPT> --dns-01-propagation-wait=2m --dns-01-timeout=5m\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --dns-01-propagation-wait\n\n duration\n\n See DNS-01 propagation section .\n\n --dns-01-timeout\n\n duration\n\n See DNS-01 propagation section .\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --jks-alias-pwd\n\n string\n\n Password of the JKS alias entry. If not provided, the JKS password is used to protect the alias entry.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --dns-01-propagation-wait\n\n duration\n\n See DNS-01 propagation section .\n\n --dns-01-timeout\n\n duration\n\n See DNS-01 propagation section .\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --jks-alias-pwd\n\n string\n\n Password of the JKS alias entry. If not provided, the JKS password is used to protect the alias entry.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --dns-01-propagation-wait\n\n duration\n\n See DNS-01 propagation section .\n\n --dns-01-timeout\n\n duration\n\n See DNS-01 propagation section .\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --jks-alias-pwd\n\n string\n\n Password of the JKS alias entry. If not provided, the JKS password is used to protect the alias entry.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to control.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Table 27. Modify Generic options\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Edit\n\n The edit command allows to change automation data on managed certificates.\n\n Parameters\n\n Table 28. Edit selection parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --ids\n\n string array (comma separated)\n\n Identifiers of the services to edit. Supports glob syntax\n\n --serials\n\n string array (comma separated)\n\n Serial numbers of the certificates to edit all its services\n\n Table 29. Edit state parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --no-install\n\n boolean\n\n Change the no-install value for targeted services\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove --ids <id1>, …​, <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove --ids all command to remove all certificates from the local database.\n\n To select certificates to remove, another option is to use the --serials option with the serials of the certificates to remove.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 30. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 31. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 32. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 33. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 34. Remove parameters\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --ids\n\n string list\n\n Ids of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n --serials\n\n string list\n\n Serials of the certificates to remove. All linked services will be removed. See automate list to get the serial.\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove --ids all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove --ids nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove --ids nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove --ids nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore --ids tomcat-*:8443\n\n Bulk Operations\n Horizon-cli 1.17.0 release notes", "keywords": [ "automation", "html", @@ -4026,35 +2556,51 @@ ] }, { - "page_id": "horizon-cli:1.9:bulk.html", + "page_id": "horizon-cli:1.17:basic.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.17", + "title": "Basic commands", + "section": "basic.html", + "slug": "basic.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/basic.html", + "breadcrumbs": ["Horizon Client", "Basic commands"], + "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", + "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", + "keywords": ["basic", "commands", "html", "horizon", "client"] + }, + { + "page_id": "horizon-cli:1.17:bulk.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", + "version": "1.17", "title": "Bulk operations", "section": "bulk.html", "slug": "bulk.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", "keywords": ["bulk", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.9:config.html", + "page_id": "horizon-cli:1.17:config.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", + "version": "1.17", "title": "General Configuration and Usage", "section": "config.html", "slug": "config.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], - "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", - "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration content\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n /opt/horizon/etc/horizon-cli.conf\n\n /usr/local/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n The configuration file is in JSON format and contains the following:\n\n {\n \"api_id\": \"API-ID\",\n \"api_key\": \"API-Key\",\n \"endpoint\": \"endpoint url. e.g. https://horizon-test.evertrust.fr\",\n \"debug\": false,\n \"timeout\": 2,\n \"proxy\": \"proxy. e.g. http://myproxy.corp.local:3128\",\n \"root_ca\": \"Root CA PEM Certificate(s).\",\n \"log_file\": \"The log file of Horizon.\"\n}\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n https_proxy\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Introduction\n Discovery Operations", + "summary": "General Configuration and Usage Installation Package install/uninstall Installing the package RPM Windows Binary Installing from the Evertrust repository Create a /etc/yum.repos.d/horizon-cli.repo file containing the EverTrust repository in", + "content": "General Configuration and Usage\n\n Installation\n\n Package install/uninstall\n\n Installing the package\n\n RPM\n\n Windows\n\n Binary\n\n Installing from the Evertrust repository\n\n Create a /etc/yum.repos.d/horizon-cli.repo file containing the EverTrust repository info:\n\n [horizon-cli]\nenabled=1\nname=Horizon Client Repository\nbaseurl=https://repo.evertrust.io/repository/horizon-cli-rpm/\ngpgcheck=1\ngpgkey=https://evertrust.io/.well-known/rpm/gpg.pub\nusername=<username>\npassword=<password>\n\n Replace <username> and <password> with the credentials you were provided.\n\n Make sure the Evertrust GPG key is trusted:\n\n # rpm --import https://evertrust.io/.well-known/rpm/gpg.pub\n\n You can then run the following to install the latest Horizon Client version:\n\n # yum install horizon-cli\n\n To prevent unattended upgrades when running yum update, you should pin the Horizon Client version by adding\n\n exclude=horizon-cli\n\n at the end of the /etc/yum.repos.d/horizon-cli.repo file after installing Horizon Client.\n\n Installing from the package file\n\n Download the latest RPM for Horizon Client on the Official EVERTRUST repository .\n\n Upload the file ' horizon-cli-<latest>.x86_64.rpm ' to the server;\n\n Access the server with an account with administrative privileges;\n\n Install the Horizon Client package with the following command:\n\n # yum localinstall /root/horizon-cli-<latest>.x86_64.rpm\n\n If you wish to verify the signature of the RPM package, the EVERTRUST key can be added to your trusted keys using the following command:\n\n # rpm --import https://evertrust.io/.well-known/rpm/gpg.pub\n\n The signature can then be verified using the following command:\n\n # rpm -K /root/horizon-cli-<latest>.x86_64.rpm\n\n To install the package, double click on the MSI file and follow the instructions.\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the PATH , in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n # chmod +x horizon-cli.bin\n\n Uninstalling the package\n\n RPM\n\n Windows\n\n Binary\n\n # yum remove horizon-cli\n\n To uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Remove the binary file from your system, and remove it from PATH\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n $ horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n $ horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\n Configuration customization\n\n Changing the configuration file location\n\n In case you want to change the configuration file location, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\n Changing all horizon-client files location\n\n Additional files are used by the client (automation state, log files, etc). In case you want to change the path to these configurations, the HRZ_LOCAL_DATA environment variable can contain an absolute path to a folder, and will create all necessary files starting from this folder.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n $ horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", "keywords": [ "general", "configuration", @@ -4067,35 +2613,35 @@ ] }, { - "page_id": "horizon-cli:1.9:discovery.html", + "page_id": "horizon-cli:1.17:discovery.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", + "version": "1.17", "title": "Discovery Operations", "section": "discovery.html", "slug": "discovery.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", - "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n General Configuration and Usage\n Import operations", + "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Scanned folders\n\n By default, localscan will scan these commonly used paths:\n\n On Unix: /usr/local/etc , /etc and /opt\n\n On Windows: user store , machine store , program data , program files , program files x86\n\n To disable scanning these paths, use the --exclude-default-paths option.\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n If you wish to also scan the TLS versions and supported cipher suites of the scanned ports, you can use the --scan-supported-tls option.\n\n Due to technical limitations in the GO runtime, some cipher suites cannot be tested.\n\n The recommended approach is to import an nmap scan using nmap import .\n\n Supported cipher suites\n\n TLS_AES_128_GCM_SHA256\n\n TLS_AES_256_GCM_SHA384\n\n TLS_CHACHA20_POLY1305_SHA256\n\n TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA\n\n TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA\n\n TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\n\n TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\n\n TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\n\n TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\n\n TLS_RSA_WITH_RC4_128_SHA\n\n TLS_RSA_WITH_3DES_EDE_CBC_SHA\n\n TLS_RSA_WITH_AES_128_CBC_SHA\n\n TLS_RSA_WITH_AES_256_CBC_SHA\n\n TLS_RSA_WITH_AES_128_CBC_SHA256\n\n TLS_RSA_WITH_AES_128_GCM_SHA256\n\n TLS_RSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_ECDSA_WITH_RC4_128_SHA\n\n TLS_ECDHE_RSA_WITH_RC4_128_SHA\n\n TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256\n\n TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256\n\n Source : https://go.dev/src/crypto/tls/cipher_suites.go\n\n horizon-cli netscan --campaign=test --scan-supported-tls\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n If the ssl-enum-ciphers was also used on the scan, the TLS ciphers for the certificates will also be sent to Horizon.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into Horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Tenable.sc Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Tenable.sc into Horizon.\n\n To utilize this feature, you need to ensure that you have valid credentials for Tenable.sc with the necessary permissions to access and export scan data and the scan name on which you want to perform the import. Additionally, you must know your Tenable.sc hostname through which Horizon Client will communicate with the Tenable.sc API and use the \"SSL Certificate Information\" plugin output to get the certificates into Horizon.\n\n horizon-cli importscan tenable-sc --campaign=<campaign> --scan-name=<name of the scan> --hostname=<tenable.sc instance>\n\n Basic commands\n Import operations", "keywords": ["discovery", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.9:est.html", + "page_id": "horizon-cli:1.17:est.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", + "version": "1.17", "title": "EST Certificate Lifecycle Operations", "section": "est.html", "slug": "est.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", - "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", + "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", "keywords": [ "est", "certificate", @@ -4107,222 +2653,99 @@ ] }, { - "page_id": "horizon-cli:1.9:import.html", + "page_id": "horizon-cli:1.17:import.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", + "version": "1.17", "title": "Import Operations", "section": "import.html", "slug": "import.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", - "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", + "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n It is also possible to attach the AWS ACM third-party connector metadata to the discovered certificates, so that when the certificate is later managed in Horizon, renewals update the existing ACM object instead of creating a new one.\n\n In order to activate this behavior, the --connector flag must reference a valid AWS ACM Connector in Horizon.\n\n horizon-cli netimport aws-acm --campaign=test --connector=<Horizon AWS ACM Connector name> --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\nIf the certificate is already managed on a WebRA profile, the \"Synchronize data from discovery\" option must be enabled in the profile configuration, and the profile must reference the connector given as argument.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n It is also possible to attach the AKV third-party connector metadata (connector reference and vault object name) to the discovered certificates, so that when the certificate is later managed in Horizon, renewals update the existing AKV object instead of creating a new one.\n\n In order to activate this behavior, the --connector flag must reference a valid AKV Connector in Horizon.\n\n horizon-cli netimport akv --campaign=test --connector=<Horizon AKV Connector name> --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\nIf the certificate is already managed on a WebRA profile, the \"Synchronize data from discovery\" option must be enabled in the profile configuration, and the profile must reference the connector given as argument.\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n --merge-third-party enables fine tracking of the certificate across multiple SSL profiles. Enable this flag only with Horizon version superior or equal to 2.7.18\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Nameshield\n\n You can import all your certificates from Nameshield certificates.\n\n horizon-cli netimport nameshield --campaign=test --token=<token>\n\n Panorama\n\n You can import all your certificates from PaloAlto Panorama.\n\n The required permissions for the scan operation are:\n\n XML API: Configuration\n\n horizon-cli netimport panorama --campaign=test --api-key=<api key> --hostname <panorama host>\n\nBy default, only the certificates deployed on the panorama (internal config and templates) will be scanned. If you wish to also scan each device managed by the panorama, use the --scan-devices option. If you do so, the Operational Requests permission must be added to the service account.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", "keywords": ["import", "operations", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.9:introduction.html", + "page_id": "horizon-cli:1.17:introduction.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", + "version": "1.17", "title": "Introduction", "section": "introduction.html", "slug": "introduction.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", - "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n This document is specific to Horizon Client version 1.9 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n General Configuration and Usage", + "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.17 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", "keywords": ["introduction", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.9:release-notes:1.9.0", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.9", - "title": "Horizon Cli 1.9.0 release notes", - "section": "release-notes", - "slug": "release-notes/1.9.0", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.0.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.9.0 release notes" - ], - "summary": "Horizon Cli 1.9.0 release notes Here are the release notes for EverTrust Horizon Client v1.9.0, released on 2024-02-27. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HCL-249", - "content": "Horizon Cli 1.9.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.9.0, released on 2024-02-27.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCL-249] - Add ACME External support for automation\n\n [HCL-250] - Add WebRA import command\n\n 2. Enhancements\n\n [HCL-327] - Add support of AES PKCS#12\n\n [HCL-320] - Rename Windows certificate store parameters\n\n [HCL-189] - Add exportable keys parameters (Windows only)\n\n [HCL-322] - Add support for legacy cryptography providers (Windows only)\n\n [HCL-330] - Support additional key types\n\n [HCL-331] - Add support for SAN URI\n\n [HCL-334] - Add hostname and IP to netscan events\n\n [HCL-251] - Improve helper ( -h ) texts\n\n [HCL-321] - Post enrollment script logs are now logged by horizon-client\n\n 3. Bug Fixes\n\n [HCL-318] - EST: Fixed a bug where it was impossible to renew to a different file\n\n [HCL-315] - Localscan: Fixed a bug where it was impossible to import csv containing one liner certificates\n\n 4. Reworked features\n\n [HCL-113] - Transferred ACME Certificate Lifecycle Operations to automation module\n\n 5. Known defects\n\n [None]\n\n Horizon Cli 1.9.1 release notes", - "keywords": [ - "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.9:release-notes:1.9.1", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.9", - "title": "Horizon Cli 1.9.1 release notes", - "section": "release-notes", - "slug": "release-notes/1.9.1", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.1.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.9.1 release notes" - ], - "summary": "Horizon Cli 1.9.1 release notes Here are the release notes for EverTrust Horizon Client v1.9.1, released on 2024-03-21. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.9.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.9.1, released on 2024-03-21.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HCL-347] - Fix packaging issue forcing dependency on glibc\n\n 4. Known defects\n\n [None]\n\n Horizon Cli 1.9.2 release notes\n Horizon Cli 1.9.0 release notes", - "keywords": [ - "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.9:release-notes:1.9.2", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.9", - "title": "Horizon Cli 1.9.2 release notes", - "section": "release-notes", - "slug": "release-notes/1.9.2", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.2.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.2.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.9.2 release notes" - ], - "summary": "Horizon Cli 1.9.2 release notes Here are the release notes for EverTrust Horizon Client v1.9.2, released on 2024-04-17. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.9.2 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.9.2, released on 2024-04-17.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-346] - Netscan: Send \"host does not resolve\" error to horizon\n\n [HCL-351] - Localimport: Add csv template value to certificate metadata\n\n 3. Bug Fixes\n\n [HCL-341] - Localimport: no longer fails on DER-encoded and empty files\n\n [HCL-343] - Fix JWT failure on specific key types\n\n [HCL-344] - Eventscheck: fix compatibility with Horizon v2.5\n\n [HCL-350] - Importscan: qualyscv now returns all scanned certificates\n\n [HCL-357] - Localimport: no longer fails on PKCS#12 containing a chain\n\n 4. Known defects\n\n [None]\n\n Horizon Cli 1.9.3 release notes\n Horizon Cli 1.9.1 release notes", - "keywords": [ - "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.9:release-notes:1.9.3", + "page_id": "horizon-cli:1.17:release-notes:1.17.0", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", - "title": "Horizon Cli 1.9.3 release notes", + "version": "1.17", + "title": "Horizon-cli 1.17.0 release notes", "section": "release-notes", - "slug": "release-notes/1.9.3", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.3.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.3.html", + "slug": "release-notes/1.17.0", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/release-notes/1.17.0.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/release-notes/1.17.0.html", "breadcrumbs": [ "Horizon Client", "Release notes", - "Horizon Cli 1.9.3 release notes" + "Horizon-cli 1.17.0 release notes" ], - "summary": "Horizon Cli 1.9.3 release notes Here are the release notes for EverTrust Horizon Client v1.9.3, released on 2024-07-25. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.9.3 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.9.3, released on 2024-07-25.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-372] - QualysCV: Improve compatibility\n\n [HCL-367] - NetImport/Importscan: Add the possibility to choose a proxy to access the external resource\n\n 3. Bug Fixes\n\n [HCL-369] - WebRA Import is now possible without private key\n\n 4. Known defects\n\n [None]\n\n Horizon Cli 1.9.4 release notes\n Horizon Cli 1.9.2 release notes", + "summary": "Horizon-cli 1.17.0 release notes Here are the release notes for EverTrust Horizon Client v1.17.0, released on 2026-06-19. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features The ne", + "content": "Horizon-cli 1.17.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.17.0, released on 2026-06-19.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n The netimport akv and netimport aws-acm commands now expose a --connector flag to attach the corresponding third-party connector metadata to discovered certificates, enabling renewals to update the existing AKV or ACM object instead of creating a new one\n\n ACME automation commands using DNS-01 challenges can now bypass the client-side authoritative name server propagation pre-check and tune the DNS-01 operation timing through the --dns-01-propagation-wait and --dns-01-timeout flags\n\n Automation commands can now set a dedicated password on the JKS alias entry using the --jks-alias-pwd option\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n Automation: Removed an erroneous backup log emitted during new enrollments on generic targets\n\n Localimport: Fixed an issue where certificates encoded as DER Hex strings could not be imported from CSV files\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation", "keywords": [ - "horizon", - "cli", + "horizon-cli", + "17", "release", "notes", "release-notes", "release-notes/1", - "client" - ] - }, - { - "page_id": "horizon-cli:1.9:release-notes:1.9.4", - "product": "horizon-cli", - "kind": "companion", - "source": "antora", - "version": "1.9", - "title": "Horizon Cli 1.9.4 release notes", - "section": "release-notes", - "slug": "release-notes/1.9.4", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.4.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.4.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.9.4 release notes" - ], - "summary": "Horizon Cli 1.9.4 release notes Here are the release notes for EverTrust Horizon Client v1.9.4, released on 2024-08-29. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.9.4 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.9.4, released on 2024-08-29.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HCL-379] - EST/Renew: Fix and update windows certificate store flags\n\n 4. Known Defects\n\n [None]\n\n Horizon Cli 1.9.5 release notes\n Horizon Cli 1.9.3 release notes", - "keywords": [ "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", "client" ] }, { - "page_id": "horizon-cli:1.9:release-notes:1.9.5", + "page_id": "horizon-cli:1.17:requirements.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", - "title": "Horizon Cli 1.9.5 release notes", - "section": "release-notes", - "slug": "release-notes/1.9.5", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.5.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.9/release-notes/1.9.5.html", - "breadcrumbs": [ - "Horizon Client", - "Release notes", - "Horizon Cli 1.9.5 release notes" - ], - "summary": "Horizon Cli 1.9.5 release notes Here are the release notes for EverTrust Horizon Client v1.9.5, released on 2024-09-30. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2", - "content": "Horizon Cli 1.9.5 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.9.5, released on 2024-09-30.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCL-382] - SCEP/EST: Allow no authentication for auto-validation\n\n 3. Bug Fixes\n\n [HCL-387] - WebRA: Fixed a bug when enrolling with the --now option\n\n [HCL-389] - Automation command now exits with code 1 when one or more operation fail\n\n [HCL-386] - Fixed a bug that blocked ACME validation on IIS\n\n 4. Known Defects\n\n [HCL-387] - Above fix for the --now option does not cover all use cases\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.9.4 release notes", - "keywords": [ - "horizon", - "cli", - "release", - "notes", - "release-notes", - "release-notes/1", - "client" - ] + "version": "1.17", + "title": "Requirements", + "section": "requirements.html", + "slug": "requirements.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/requirements.html", + "breadcrumbs": ["Horizon Client", "Requirements"], + "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", + "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit);\n\n Microsoft Windows Server 2025 (64-bit);\n\n Introduction\n General Configuration and Usage", + "keywords": ["requirements", "html", "horizon", "client"] }, { - "page_id": "horizon-cli:1.9:scep.html", + "page_id": "horizon-cli:1.17:scep.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", + "version": "1.17", "title": "SCEP Certificate Lifecycle Operations", "section": "scep.html", "slug": "scep.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" ], "summary": "SCEP Certificate Lifecycle Operations The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode. Usage: horizon-cli scep [co", - "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Challenge password in decentralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the SCEP profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli scep enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the SCEP profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the SCEP request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli scep enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n horizon-cli scep enroll --profile=<profile> --challenge=<challenge> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Enrollment with lots of metadata and output as PKCS#12\n\n horizon-cli scep enroll \\\n --profile=<profile> \\\n --challenge=<challenge> \\\n --key-type=rsa-2048 \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n Renewal with output as key and certificate\n\n horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --cert=/path/to/cert --key=/path/to/key\n\n EST Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", + "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Challenge password in decentralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the SCEP profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli scep enroll --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the SCEP profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the SCEP request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli scep enroll --challenge=<challenge> --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n horizon-cli scep enroll --profile=<profile> --challenge=<challenge> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Enrollment with lots of metadata and output as PKCS#12\n\n horizon-cli scep enroll \\\n --profile=<profile> \\\n --challenge=<challenge> \\\n --key-type=rsa-2048 \\\n --dn=CN=test.example.com,OU=it \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n Renewal with output as key and certificate\n\n horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --cert=/path/to/cert --key=/path/to/key\n\n EST Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", "keywords": [ "scep", "certificate", @@ -4334,16 +2757,16 @@ ] }, { - "page_id": "horizon-cli:1.9:update.html", + "page_id": "horizon-cli:1.17:update.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", + "version": "1.17", "title": "Update operations", "section": "update.html", "slug": "update.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -4358,22 +2781,22 @@ ] }, { - "page_id": "horizon-cli:1.9:webra.html", + "page_id": "horizon-cli:1.17:webra.html", "product": "horizon-cli", "kind": "companion", "source": "antora", - "version": "1.9", + "version": "1.17", "title": "WebRA Certificate Lifecycle Operations", "section": "webra.html", "slug": "webra.html", - "url": "https://docs.evertrust.fr/horizon-cli/1.9/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" ], "summary": "WebRA Certificate Lifecycle Operations The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation. WebRA operations validation Like SCEP and EST,", - "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n --ms-guid\n\n Requested Microsoft GUID. Single value\n\n --ms-sid\n\n Requested Microsoft SID. Single value\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Import\n\n The `webra import`command is designed to import a certificate and its key on a profile.\n\n Import parameters\n\n Table 11. WebRA import parameters\n\n Parameter\n\n Description\n\n --profile\n\n Existing profile on which to import\n\n Table 12. Metadata parameters\n\n Parameter\n\n Description\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --contact-email\n\n Contact email of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n --metadata\n\n Technical metadata of the imported certificate, in key:value form\n\n Input parameters\n\n These parameters define how to find the certificate to import. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 13. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to import (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to import if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to import\n\n --in-jks-pwd\n\n Password for the JKS file to import\n\n --in-jks-alias\n\n Alias for the certificate to import in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to import\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Revocation parameters\n\n Define how to revoke this certificate:\n\n Table 14. WebRA revocation parameters\n\n Parameter\n\n Description\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n Input parameters\n\n These parameters define how to find the certificate to revoke. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 15. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --in-jks-pwd\n\n Password for the JKS file to revoke\n\n --in-jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra enroll --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n horizon-cli webra enroll \\\n --profile=<profile> \\\n --cn=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n after this command, run periodically:\n\n horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra renew --in-cert /path/to/old/cert --in-key /path/to/old/key --cert /path/to/cert --key /path/to/key --now\n\n Revocation of a certificate\n\n horizon-cli webra revoke --in-cert /path/to/cert --in-key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", + "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n --ms-guid\n\n Requested Microsoft GUID. Single value\n\n --ms-sid\n\n Requested Microsoft SID. Single value\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Import\n\n The `webra import`command is designed to import a certificate and its key on a profile.\n\n Import parameters\n\n Table 11. WebRA import parameters\n\n Parameter\n\n Description\n\n --profile\n\n Existing profile on which to import\n\n Table 12. Metadata parameters\n\n Parameter\n\n Description\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --contact-email\n\n Contact email of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n --metadata\n\n Technical metadata of the imported certificate, in key:value form\n\n Input parameters\n\n These parameters define how to find the certificate to import. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 13. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to import (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to import if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to import\n\n --in-jks-pwd\n\n Password for the JKS file to import\n\n --in-jks-alias\n\n Alias for the certificate to import in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to import\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Revocation parameters\n\n Define how to revoke this certificate:\n\n Table 14. WebRA revocation parameters\n\n Parameter\n\n Description\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n Input parameters\n\n These parameters define how to find the certificate to revoke. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 15. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --in-jks-pwd\n\n Password for the JKS file to revoke\n\n --in-jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra enroll --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n horizon-cli webra enroll \\\n --profile=<profile> \\\n --dn=CN=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n after this command, run periodically:\n\n horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra renew --in-cert /path/to/old/cert --in-key /path/to/old/key --cert /path/to/cert --key /path/to/key --now\n\n Revocation of a certificate\n\n horizon-cli webra revoke --in-cert /path/to/cert --in-key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", "keywords": [ "webra", "certificate", diff --git a/src/generated/docs/doc-versions.json b/src/generated/docs/doc-versions.json index 59e24db..94c907f 100644 --- a/src/generated/docs/doc-versions.json +++ b/src/generated/docs/doc-versions.json @@ -1,20 +1,10 @@ { - "generatedAt": "2026-06-17T17:03:57.182Z", + "generatedAt": "2026-07-01T08:12:21.623Z", "products": { "horizon": { "product": "horizon", "latest": "2.10", - "versions": [ - "2.2", - "2.3", - "2.4", - "2.5", - "2.6", - "2.7", - "2.8", - "2.9", - "2.10" - ], + "versions": ["2.5", "2.6", "2.7", "2.8", "2.9", "2.10"], "defaultPolicy": "connected-instance", "provenance": "Official Evertrust documentation sitemap" }, @@ -41,21 +31,8 @@ }, "horizon-cli": { "product": "horizon-cli", - "latest": "1.16", - "versions": [ - "1.5", - "1.6", - "1.7", - "1.8", - "1.9", - "1.10", - "1.11", - "1.12", - "1.13", - "1.14", - "1.15", - "1.16" - ], + "latest": "1.17", + "versions": ["1.11", "1.12", "1.13", "1.14", "1.15", "1.16", "1.17"], "defaultPolicy": "latest-indexed", "provenance": "Official Evertrust documentation sitemap" }, diff --git a/src/generated/docs/product-doc-pages.json b/src/generated/docs/product-doc-pages.json index fd03afe..a769474 100644 --- a/src/generated/docs/product-doc-pages.json +++ b/src/generated/docs/product-doc-pages.json @@ -1,6 +1,6 @@ { - "generatedAt": "2026-06-17T17:03:09.009Z", - "pageCount": 1317, + "generatedAt": "2026-07-01T08:11:06.995Z", + "pageCount": 1006, "pages": [ { "page_id": "horizon:2.10:admin-guide:archives", @@ -4841,7 +4841,7 @@ "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/tenancy.html", "breadcrumbs": ["Horizon", "Installation", "Multi-Tenancy"], "summary": "Multi-Tenancy Activation In order to activate multi-tenancy on an instance, a specific license must be used. Contact the Evertrust team for access. Multi-tenancy must be enabled when provisioning a new instance, and cannot be disabled after", - "content": "Multi-Tenancy\n\n Activation\n\n In order to activate multi-tenancy on an instance, a specific license must be used.\nContact the Evertrust team for access.\n\nMulti-tenancy must be enabled when provisioning a new instance, and cannot be disabled afterwards.\nThis means that switching an instance between multi-tenancy modes is not possible.\n\n Tenant isolation\n\n Horizon uses logical isolation, meaning that a single database is used for all tenants of an instance.\n\n To discriminate between tenants, Horizon uses the x-tenant header.\nUsing a header allows for a highly customizable tenant access model.\nIt should be enabled on the reverse proxy.\n\nNo x-tenant header means that Horizon will load the root tenant context\n\n Here is an example architecture:\n\n In this architecture, the content of the x-tenant header is set by the reverse proxy based on the prefix before the evertrust.io domain, with a specific rule for the root domain.\n\n Root tenant\n\n The root tenant is the base tenant of a multi-tenant instance.\nIt has limited capabilities, mostly linked to user and tenant management.\n\nThe root tenant cannot access any of its tenant data, and can only manage tenants, not their data.\n\n Tenant management\n\n For tenant management, please refer to the Administration Guide\n\n Specific configuration\n\n On a multi-tenant instance, some system queues are shared across tenants.\nIf the instance sees heavy usage, the following parameters should be altered :\n\n The CRL cache synchronization parallelism and size\n\n The CRL database synchronization parallelism and size\n\n The default PKI queue parallelism and size\n\n Secrets\n\n On a multi-tenant instance, secrets for a tenant (credentials, private keys, …​) are encrypted using its own Tink keyset.\nThis keyset is itself encrypted with the instance keyset.\nThis ensures secrets are completely isolated from one tenant to another.\n\n Logging\n Endpoint configuration", + "content": "Multi-Tenancy\n\n Activation\n\n In order to activate multi-tenancy on an instance, a specific license must be used.\nContact the Evertrust team for access.\n\nMulti-tenancy must be enabled when provisioning a new instance, and cannot be disabled afterwards.\nThis means that switching an instance between multi-tenancy modes is not possible.\n\n Tenant isolation\n\n Horizon uses logical isolation, meaning that a single database is used for all tenants of an instance.\n\n To discriminate between tenants, Horizon uses the x-tenant header.\nUsing a header allows for a highly customizable tenant access model.\nIt should be enabled on the reverse proxy.\n\nNo x-tenant header means that Horizon will load the root tenant context\n\n Here is an example architecture:\n\n In this architecture, the content of the x-tenant header is set by the reverse proxy based on the prefix before the evertrust.io domain, with a specific rule for the root domain.\n\n Root tenant\n\n The root tenant is the base tenant of a multi-tenant instance.\nIt has limited capabilities, mostly linked to user and tenant management.\n\nThe root tenant cannot access any of its tenant data, and can only manage tenants, not their data.\n\n Tenant management\n\n For tenant management, please refer to the Administration Guide\n\n Specific configuration\n\n On a multi-tenant instance, some system queues are shared across tenants.\nIf the instance sees heavy usage, the following parameters should be altered :\n\n The CRL cache synchronization parallelism and size\n\n The CRL database synchronization parallelism and size\n\n The default PKI queue parallelism and size\n\n Secrets\n\n On a multi-tenant instance, secrets for a tenant (credentials, private keys, …​) are encrypted using its own Tink keyset.\nThis keyset is itself encrypted with the instance keyset.\nThis ensures secrets are completely isolated from one tenant to another.\n\n Logging\n\n On a multi-tenant instance, the tenant information can be added to logs.\n\n RPM\n\n Debian\n\n Kubernetes\n\n The tenant information is already added to standard logs if you are using the JSON or SYSLOG encoder.\n\n If you are using the standard line format, you can add the tenant information using the %contextTag{tenant} keyword anywhere in the pattern.\n\n To edit the pattern, follow the standard log_format \" class=\"xref page\">steps .\n\n The tenant information is already added to standard logs if you are using the JSON or SYSLOG encoder.\n\n If you are using the standard line format, you can add the tenant information using the %contextTag{tenant} keyword anywhere in the pattern.\n\n To edit the pattern, follow the standard log_format \" class=\"xref page\">steps .\n\n The tenant information is already added to standard logs if you are using the json format.\n\n However, if you are using the json_events logger, the tenant information is not added by default.\n\n To add it, one must modify the contents of the /horizon/etc/logback.xml file.\n\n The following modification should be applied to the contents of the json_events appender:\n\n <pattern>\n {\n \"event\": \"#asJson{%message}\",\n \"tenant\": \"%contextTag{tenant}\", (1)\n \"type\": \"event\"\n }\n</pattern>\n\n 1\n This line adds the tenant key to the JSON event logs, and outputs an empty string when no tenant is linked to this event.\n\n Logging\n Endpoint configuration", "keywords": [ "multi-tenancy", "install-guide", @@ -4979,7 +4979,7 @@ "Horizon 2.10.0 release notes" ], "summary": "Horizon 2.10.0 release notes Here are the release notes for EverTrust Horizon v2.10.0, released on 2026-06-16. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. Tink AWS now uses AWS SDK v2 cred", - "content": "Horizon 2.10.0 release notes\n\n Here are the release notes for EverTrust Horizon v2.10.0, released on 2026-06-16.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\nTink AWS now uses AWS SDK v2 credentials config. If you used AWS for the tink keyset, your credentials might need to be updated.\n\nWebRA third party scheduled tasks renew capability has been removed. Migrate to enabling auto renewal for renewal workflows.\n\n 1. New Features\n\n DCV Module: Horizon can now automate the Domain Control Validation lifecycle for public certificates. Learn more …​\n\n Certificates can now be automatically renewed through centralized issuance on the WebRA module. Learn more …​\n\n Asynchronous certificate lifecycle APIs are now supported for asynchronous PKI connectors. Learn more …​\n\n Workloads and services can now authenticate to Horizon using a service account based on JWKS scheme. Learn more …​\n\n Announcements can now be defined and displayed in the Web UI for maintenance schedules or major incidents. Learn more …​\n\n When renewing public PKI certificates, if the order is still valid on the underlying PKI, Horizon will now reissue a certificate on the same order. Learn more …​\n\n Certificate enrollment workflows can now require Terms of Service acceptance. Learn more …​\n\n The X509 authentication identifier can now be configured to produce custom identifiers. Learn more …​\n\n Datasources can now be defined as mandatory on a certificate profile, stopping enrollment requests when the data source mapping returns no result. Learn more …​\n\n Horizon now supports dynamic storage backends for archives and reports. Learn more …​\n\n Client Authentication CAs can now be exported to be used for reverse proxy certificate selection. Learn more …​\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [None]\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n On the tenant configuration resource /api/v1/security/tenants , the licenseLimit and licenseExpiration was moved to a complex object to account for new license entitlements.\n\n Horizon 2.10.1 release notes\n Configure tunnels", + "content": "Horizon 2.10.0 release notes\n\n Here are the release notes for EverTrust Horizon v2.10.0, released on 2026-06-16.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\nTink AWS now uses AWS SDK v2 credentials config. If you used AWS for the tink keyset, your credentials might need to be updated.\n\nWebRA third party scheduled tasks renew capability has been removed. Migrate to enabling auto renewal for renewal workflows.\n\n 1. New Features\n\n DCV Module: Horizon can now automate the Domain Control Validation lifecycle for public certificates. Learn more …​\n\n Certificates can now be automatically renewed through centralized issuance on the WebRA module. Learn more …​\n\n Asynchronous certificate lifecycle APIs are now supported for asynchronous PKI connectors. Learn more …​\n\n Workloads and services can now authenticate to Horizon using a service account based on JWKS scheme. Learn more …​\n\n Announcements can now be defined and displayed in the Web UI for maintenance schedules or major incidents. Learn more …​\n\n When renewing public PKI certificates, if the order is still valid on the underlying PKI, Horizon will now reissue a certificate on the same order. Learn more …​\n\n Certificate enrollment workflows can now require Terms of Service acceptance. Learn more …​\n\n The X509 authentication identifier can now be configured to produce custom identifiers. Learn more …​\n\n Datasources can now be defined as mandatory on a certificate profile, stopping enrollment requests when the data source mapping returns no result. Learn more …​\n\n Horizon now supports dynamic storage backends for archives and reports. Learn more …​\n\n Client Authentication CAs can now be exported to be used for reverse proxy certificate selection. Learn more …​\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [None]\n\n 4. Known Defects\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.10.2\n\n 5. API modifications\n\n On the tenant configuration resource /api/v1/security/tenants , the licenseLimit and licenseExpiration was moved to a complex object to account for new license entitlements.\n\n Horizon 2.10.1 release notes\n Configure tunnels", "keywords": [ "horizon", "10", @@ -5006,7 +5006,7 @@ "Horizon 2.10.1 release notes" ], "summary": "Horizon 2.10.1 release notes Here are the release notes for EverTrust Horizon v2.10.1, released on 2026-06-17. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhance", - "content": "Horizon 2.10.1 release notes\n\n Here are the release notes for EverTrust Horizon v2.10.1, released on 2026-06-17.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n Fixed an issue where the license count was not displayed correctly for legacy licenses\n\n Fixed an issue where disabling a DCV policy did not cancel its scheduled execution\n\n Fixed an issue where the \"Follow criteria\" action on the events page did not behave as expected\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Searching requests and certificates\n Horizon 2.10.0 release notes", + "content": "Horizon 2.10.1 release notes\n\n Here are the release notes for EverTrust Horizon v2.10.1, released on 2026-06-17.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n Fixed an issue where the license count was not displayed correctly for legacy licenses\n\n Fixed an issue where disabling a DCV policy did not cancel its scheduled execution\n\n Fixed an issue where the \"Follow criteria\" action on the events page did not behave as expected\n\n 4. Known Defects\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.10.2\n\n 5. API modifications\n\n [None]\n\n Horizon 2.10.2 release notes\n Horizon 2.10.0 release notes", "keywords": [ "horizon", "10", @@ -5017,9001 +5017,23 @@ ] }, { - "page_id": "horizon:2.10:user-guide:est", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "How to Request an EST challenge", - "section": "user-guide", - "slug": "user-guide/est", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/est.html", - "breadcrumbs": ["Horizon", "User guide", "Requesting an EST challenge"], - "summary": "How to Request an EST challenge This section details how you can get an EST Challenge. 1. Log in to Horizon Registration Authority Interface 2. Access Request an EST Challenge from the drawer: Request an EST Challenge You must have the perm", - "content": "How to Request an EST challenge\n\n This section details how you can get an EST Challenge.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access Request an EST Challenge from the drawer: Request an EST Challenge\n\n You must have the permission to request an EST challenge on at least one EST profile.\n\n Profile tab\n\n 1. Select the EST profile.\n\n 2. Click on next button.\n\n Metadata tab\n\n 1. Fill in all the mandatory fields:\n\n Labels(string):\n\nThe labels are used for permission, email and request search.\n\n Contact email address(string email format):\n\nUsed if an email notification is set. An email can be sent each time the request status changes (see request lifecycle ).\n\n Requester comment(string):\n\nThis comment appears:\n\n to the approver when your request is in the pending status\n\n in the certificate information after the enrollment\n\n 2. Click on next button\n\n Summary\n\n If you own the enrolling permission on the EST profile:\n\n 1. Click on the Retrieve challenge button\n\n If you own the \"request\" permission on the EST profile:\n\n 1. Click on request button\n\n You have to wait that your request is approved by an operator and its status is 'completed', in order to use your EST challenge\n\n 2. click on View Request\n\n You now have access to your EST challenge\n\n You can cancel your request at any time, as long as the request status is pending, by clicking on\n\n How to enroll using EST\n\n This section details how to enroll using the Horizon Client ( horizon-cli ). It is also possible to use another EST client implementation, as long as it complies with RFC 7030.\n\n Prerequisites\n\n You need the horizon-cli tools\n\n Enroll with Horizon Client\n\n 1. Set the horizon root endpoint\n\n export ``ENDPOINT``=https://<horizon_url>\n\n The endpoint can instead be set in horizon-cli configuration file\n\n 2. Enroll with horizon-cli\n\n horizon-cli est --enroll <your_challenge> --profile <est_profile> --key <link_to_the_privatekey> --cn <certificate_cn> --cert <name_of_the_output_certificate>\n\n If the enrollment succeeds, the challenge is no longer usable, as it is a one-time password.\n\n Requesting a SCEP challenge\n Managing requests (operator)", - "keywords": [ - "how", - "to", - "request", - "an", - "est", - "challenge", - "user-guide", - "user-guide/est", - "horizon", - "user", - "guide", - "requesting" - ] - }, - { - "page_id": "horizon:2.10:user-guide:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "User guide", - "section": "user-guide", - "slug": "user-guide/introduction", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/introduction.html", - "breadcrumbs": ["Horizon", "User guide"], - "summary": "User guide Description The user guide describes how end-users should interact with Horizon. Prerequisites To use Horizon, you need the following prerequisites: an up and running Horizon instance , which you can access through your web brows", - "content": "User guide\n\n Description\n\n The user guide describes how end-users should interact with Horizon.\n\n Prerequisites\n\n To use Horizon, you need the following prerequisites:\n\n an up and running Horizon instance , which you can access through your web browser;\n\n a correctly configured platform ;\n\n Reset tenant administrator account\n Managing requests on the WebRA", - "keywords": [ - "user", - "guide", - "user-guide", - "user-guide/introduction", - "horizon" - ] - }, - { - "page_id": "horizon:2.10:user-guide:manage_requests", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "Operator", - "section": "user-guide", - "slug": "user-guide/manage_requests", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/manage_requests.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/manage_requests.html", - "breadcrumbs": ["Horizon", "User guide", "Managing requests (operator)"], - "summary": "Operator An Operator is someone who owns the permission to approve or deny a request. Manage Request This section details how to manage a request (view, approve, deny). 1. Log in to Horizon Registration Authority Interface 2. Access Manages", - "content": "Operator\n\n An Operator is someone who owns the permission to approve or deny a request.\n\n Manage Request\n\n This section details how to manage a request (view, approve, deny).\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access Manages requests from the drawer: Manage requests\n\n How to view a request\n\n 3. Click on view request button\n\n 4. Check all the information from the request\n\n 5. At the end you can either approve or deny the request\n\n How to approve a request\n\n 3. Click on approve request button and approve the request\n\n If the certificate has mandatory metadata you will need to fill it in before approving the request, otherwise you will get an error.\n\n How to deny a request\n\n 3. Click on deny request button and deny the request\n\n Requesting an EST challenge\n Searching requests and certificates", - "keywords": [ - "operator", - "user-guide", - "user-guide/manage_requests", - "horizon", - "user", - "guide", - "managing", - "requests" - ] - }, - { - "page_id": "horizon:2.10:user-guide:scep", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "How to Request a SCEP challenge", - "section": "user-guide", - "slug": "user-guide/scep", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/scep.html", - "breadcrumbs": ["Horizon", "User guide", "Requesting a SCEP challenge"], - "summary": "How to Request a SCEP challenge This section details how you can get a SCEP Challenge. 1. Log in to Horizon Registration Authority Interface 2. Access Request a SCEP Challenge from the drawer: Request a SCEP Challenge You must have the perm", - "content": "How to Request a SCEP challenge\n\n This section details how you can get a SCEP Challenge.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access Request a SCEP Challenge from the drawer: Request a SCEP Challenge\n\n You must have the permission to request a SCEP challenge on at least one SCEP profile.\n\n Profile tab\n\n 1. Select the SCEP profile\n\n 2. Click on next button\n\n Metadata tab\n\n 1. Fill in all the mandatory fields:\n\n Labels(string):\n\nThe labels are used for permission, email and request search.\n\n Contact email address(string email format):\n\nUsed if an email configuration is set. An email can be sent each time the request status changes (see request lifecycle ).\n\n Requester comment(string):\n\nThis comment appears:\n\n to the approver when your request is in the pending status\n\n in the certificate information after the enrollment\n\n 2. Click on next button\n\n Summary\n\n If you own the enrolling permission on the SCEP profile:\n\n 1. Click on the Retrieve challenge button\n\n If you own the request permission on the SCEP profile:\n\n 1. Click on request button\n\n You have to wait that your request is approved by an operator and its status is 'completed', in order to use your SCEP challenge\n\n 2. click on View Request\n\n You now have access to your SCEP challenge\n\n In order to enroll using SCEP you will need at least a challenge and the SCEP endpoint:\n\n https://<horizon_url>/scep/<profile>/pkiclient.exe\n\n In case you use the NDES emulation, the enrollment and challenge URLs will be respectively:\n- https://<horizon_url>/certsrv/<profile>/mscep\n- https://<horizon_url>/certsrv/<profile>/mscep_admin\n\n You can cancel your request at any time, as long as the request status is pending, by clicking on\n\n How to request a certificate recovery\n Requesting an EST challenge", - "keywords": [ - "how", - "to", - "request", - "scep", - "challenge", - "user-guide", - "user-guide/scep", - "horizon", - "user", - "guide", - "requesting" - ] - }, - { - "page_id": "horizon:2.10:user-guide:search", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "Searching requests and certificates", - "section": "user-guide", - "slug": "user-guide/search", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/search.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/search.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Searching requests and certificates" - ], - "summary": "Search Request Here is the section where you can search easily find all information regarding the request. How to do a simple request search 1. Log in to Horizon Registration Authority Interface 2. Access request search from the drawer: My ", - "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.10.1 release notes", - "keywords": [ - "searching", - "requests", - "and", - "certificates", - "user-guide", - "user-guide/search", - "horizon", - "user", - "guide" - ] - }, - { - "page_id": "horizon:2.10:user-guide:webra:duplicate", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "How to request a certificate duplication", - "section": "user-guide", - "slug": "user-guide/webra/duplicate", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/duplicate.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/duplicate.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate duplication" - ], - "summary": "How to request a certificate duplication A Duplication is a simplification of the enroll process. When choosing the duplication on a certificate, a new certificate enrollment request is created with the information from the previous certifi", - "content": "How to request a certificate duplication\n\n A Duplication is a simplification of the enroll process. When choosing the duplication on a certificate, a new certificate enrollment request is created with the information from the previous certificate. Certificate data and metadata are still editable, as opposed to a renewal .\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request duplication from the drawer: My certificates or Search certificates\n\n 3. Click on request duplication button\n\n Profile tab\n\n 4. Fill in all the mandatory fields\n\n Key type * (string) :\n\nThe key type will be used for the private key generation\n\n In case of the definition of a password policy:\n\n Password * (string) :\n\nThe password will be used for the PKCS#12 encryption\n\n 5. Go to enroll (same as duplicate) and follow all the steps\n\n How to request a certificate update\n How to request a certificate renewal", - "keywords": [ - "how", - "to", - "request", - "certificate", - "duplication", - "user-guide", - "user-guide/webra/duplicate", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.10:user-guide:webra:enroll", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "How to enroll a certificate using the WebRA", - "section": "user-guide", - "slug": "user-guide/webra/enroll", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/enroll.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/enroll.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to enroll a certificate using the WebRA" - ], - "summary": "How to enroll a certificate using the WebRA 1. Log in to Horizon registration authority Interface 2. Access Request Certificate from the drawer: Request Certificate Profile tab 3. Fill in all the mandatory fields Certificate profile * (stri", - "content": "How to enroll a certificate using the WebRA\n\n 1. Log in to Horizon registration authority Interface\n\n 2. Access Request Certificate from the drawer: Request Certificate\n\n Profile tab\n\n 3. Fill in all the mandatory fields\n\n Certificate profile * (string select) :\n\nThe certificate profile will be used in order to build the next step of the enrollment.\n\n If decentralized enrollment is enabled for the profile:\n\n Either:\n\n CSR * (string) :\n\nThe CSR in PEM format\n\n Import a CSR file * (file) :\n\nThe CSR file\n\n If centralized enrollment is enabled for the profile:\n\n Key type * (string select) :\n\nThe key type will be used for the private key generation\n\n In case of the definition of a password policy:\n\n Password * (string) :\n\nThe password will be used for the PKCS#12 encryption\n\n You must comply with the configured password policy.\n\n 4. Click on Next button.\n\n Data tab\n\n 5. Fill in all the mandatory fields:\n\n Subject * (string) :\n\nFill the subject fields of the certificate\n\n Subject Alternatives Names * (string) :\n\nFill the Subject Alternative Names of the certificate\n\n Extensions * (string) :\n\nFill the extensions of the certificate\n\n In decentralized mode, CSR values will be used as default for the corresponding fields.\n\n You must comply with the configured regular expression(s) that you can get with the ? icon.\n\n 6. Click on next button.\n\n Labels tab\n\n 7. Fill in all the mandatory fields:\n\n Labels * (string) :\n\nThe labels will be used for permission, email and certificate search.\n\n You must comply with the configured regular expression(s) that you can get with the ? icon.\n\n Requester comment (string) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n 8. Click on next button.\n\n Ownership tab\n\n 9. Fill in all the fields:\n\n Owner (string input) :\n\nDisplayed if an owner policy is set. The owner of the certificate can search it, and request other actions on it (such as revoke, recover, ..).\n\n Contact email address (string email format) :\n\nDisplayed if an email policy is set. An email can be sent each time the request status changes (see request lifecycle ). This will also set the contact email of the certificate.\n\n Team (string input) :\n\nDisplayed if a team policy is set. A team has the same rights as an owner on a certificate.\n\n 10. Click on next button.\n\n Summary tab\n\n If you own the enrolling permission\n\n 11. Click on enroll button\n\nYou can download the PKCS#12 after the enrollment if you are allowed to in the profile\n\n If you own the request certificate permission\n\n 11. Click on request button\n\nYou have to wait until your request is approved, afterward you will be able to download the PKCS#12 if you are allowed to in the profile\n\n Managing requests on the WebRA\n How to request a certificate revocation", - "keywords": [ - "how", - "to", - "enroll", - "certificate", - "using", - "the", - "webra", - "user-guide", - "user-guide/webra/enroll", - "horizon", - "user", - "guide", - "managing", - "requests", - "on" - ] - }, - { - "page_id": "horizon:2.10:user-guide:webra:import", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "How to request a certificate import", - "section": "user-guide", - "slug": "user-guide/webra/import", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/import.html", - "breadcrumbs": ["Horizon", "How to request a certificate import"], - "summary": "How to request a certificate import A certificate import will save the associated certificate to the requested profile, with its private key if escrow is enabled. 1. Log in to Horizon Registration Authority Interface 2. Access request renew", - "content": "How to request a certificate import\n\n A certificate import will save the associated certificate to the requested profile, with its private key if escrow is enabled.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request renew from the drawer: My certificates or Search certificates\n\n 3. Click on request renew button\n\n Renew options tab\n\n 4. Fill in all the fields\n\n Key type * (string) :\n\n Enabled on centralized enrollment: The key type will be used for the private key generation.\n\n Password * (string) :\n\n Enabled on centralized enrollment with manual password policy: The password will be used for the PKCS#12 encryption.\n\n CSR * (string) :\n\n Enabled on decentralized enrollment: The CSR, defining the public key of the enrolled certificate.\n\n Comment (string) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n Certificate tab\n\n 5. You can also check the certificate information\n\n Ownership tab\n\n 6. You can also check the certificate ownership information\n\n 7. Renew. You will obtain a strictly identical certificate to the one used for renewal, except for the key.", - "keywords": [ - "how", - "to", - "request", - "certificate", - "import", - "user-guide", - "user-guide/webra/import", - "horizon" - ] - }, - { - "page_id": "horizon:2.10:user-guide:webra:recover", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "How to request a certificate recovery", - "section": "user-guide", - "slug": "user-guide/webra/recover", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/recover.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/recover.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate recovery" - ], - "summary": "How to request a certificate recovery 1. Log in to Horizon Registration Authority Interface 2. Access request recover from the drawer: My certificates or Search certificates 3. Click on request recover button Recover Options tab 4. Fill in ", - "content": "How to request a certificate recovery\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request recover from the drawer: My certificates or Search certificates\n\n 3. Click on request recover button\n\n Recover Options tab\n\n 4. Fill in the information you want to add.\n\n Contact_Email (string email format) :\n\nUsed if an email configuration is set. An email can be sent every time the request status change (see request lifecycle ).\n\n Recover comment (string input) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n Certificate tab\n\n 5. You can also check the certificate information\n\n Ownership tab\n\n 6. You can also check the certificate ownership information\n\n 7. Once you have checked and added the information you wanted you can request the recover by clicking on the recover button\n\n 8. You will be able to see and copy the password and download the certificate PKCS#12\n\n How to request a certificate renewal\n Requesting a SCEP challenge", - "keywords": [ - "how", - "to", - "request", - "certificate", - "recovery", - "user-guide", - "user-guide/webra/recover", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.10:user-guide:webra:renew", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "How to request a certificate renewal", - "section": "user-guide", - "slug": "user-guide/webra/renew", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/renew.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/renew.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate renewal" - ], - "summary": "How to request a certificate renewal A certificate renewal will enroll a certificate strictly identical to the previous one. No edition of certificate data or metadata can take place. 1. Log in to Horizon Registration Authority Interface 2.", - "content": "How to request a certificate renewal\n\n A certificate renewal will enroll a certificate strictly identical to the previous one. No edition of certificate data or metadata can take place.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request renew from the drawer: My certificates or Search certificates\n\n 3. Click on request renew button\n\n Renew options tab\n\n 4. Fill in all the fields\n\n Key type * (string) :\n\n Enabled on centralized enrollment: The key type will be used for the private key generation.\n\n Password * (string) :\n\n Enabled on centralized enrollment with manual password policy: The password will be used for the PKCS#12 encryption.\n\n CSR * (string) :\n\n Enabled on decentralized enrollment: The CSR, defining the public key of the enrolled certificate.\n\n Comment (string) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n Certificate tab\n\n 5. You can also check the certificate information\n\n Ownership tab\n\n 6. You can also check the certificate ownership information\n\n 7. Renew. You will obtain a strictly identical certificate to the one used for renewal, except for the key.\n\n How to request a certificate duplication\n How to request a certificate recovery", - "keywords": [ - "how", - "to", - "request", - "certificate", - "renewal", - "user-guide", - "user-guide/webra/renew", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.10:user-guide:webra:revoke", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "How to request a certificate revocation", - "section": "user-guide", - "slug": "user-guide/webra/revoke", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/revoke.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/revoke.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate revocation" - ], - "summary": "How to request a certificate revocation 1. Log in to Horizon registration authority Interface 2. Access Either my certificates or Search certificates from the drawer: My Certificates / Search Certificates 3. Click on the Revoke icon The rev", - "content": "How to request a certificate revocation\n\n 1. Log in to Horizon registration authority Interface\n\n 2. Access Either my certificates or Search certificates from the drawer: My Certificates / Search Certificates\n\n 3. Click on the Revoke icon\n\n The revoke icon appears only if you own the permission to revoke the certificate\n\n Revocation Options tab\n\n 4. Fill in all the mandatory fields.\n\n Revocation reason * (String select) :\n\nThe revocation reason that will appear on the CRL\n\n Contact email address (string email format) :\n\nUsed if an email configuration is set. An email can be sent each time the request status changes (see request lifecycle )\n\n Requester comment (String) :\n\nThis comment appears:\n\n by the approver when your request is in the pending status\n\n to the certificate info after the revocation\n\n 5. Click on Certificate tab\n\n Certificate tab\n\n 6. Check the certificate’s information\n\n 7. Click on Ownership tab\n\n Ownership tab\n\n 8. Check the certificate’s ownership information\n\n If you have the revoke permission\n\n 9. Click on the revoke button\n\nThe certificate is now revoked.\n\n 9. Click on request button\n\nYou have to wait until your request is approved, afterward you will be able to see the certificate as revoked when you search for it\n\n How to enroll a certificate using the WebRA\n How to request a certificate update", - "keywords": [ - "how", - "to", - "request", - "certificate", - "revocation", - "user-guide", - "user-guide/webra/revoke", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.10:user-guide:webra:update", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "How to request a certificate update", - "section": "user-guide", - "slug": "user-guide/webra/update", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/update.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate update" - ], - "summary": "How to request a certificate update 1. Log in to Horizon Registration Authority Interface 2. Access request update from the drawer: My certificates or Search certificates 3. Click on request update button Labels tab 4. You can update in the", - "content": "How to request a certificate update\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request update from the drawer: My certificates or Search certificates\n\n 3. Click on request update button\n\n Labels tab\n\n 4. You can update in the labels section the labels\n\n Label (string input) :\n\nEnter a correct label\n\n Ownership tab\n\n 5. You can update the ownership information\n\n Owner (string input) :\n\nDisplayed if an owner policy is set. The owner of the certificate can search it, and request other actions on it (such as revoke, recover, ..).\n\n Contact email address (string email format) :\n\nDisplayed if an email policy is set. An email can be sent each time the request status changes (see request lifecycle ). This will also set the contact email of the certificate.\n\n Team (string input) :\n\nDisplayed if a team policy is set. A team has the same rights as an owner on a certificate.\n\n 6. You can also check the details information\n\n Certificate tab\n\n 7. You can also check the certificate information\n\n 8. Once you have made changes you can request the update by clicking on the update button\n\n How to request a certificate revocation\n How to request a certificate duplication", - "keywords": [ - "how", - "to", - "request", - "certificate", - "update", - "user-guide", - "user-guide/webra/update", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.10:user-guide:webra:workflow", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.10", - "title": "Request workflow", - "section": "user-guide", - "slug": "user-guide/webra/workflow", - "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/workflow.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/workflow.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA" - ], - "summary": "Request workflow Each Request has the same lifecycle described by the following figure. Figure 1. Request Workflow Requester A requester is someone who is granted the permission to request a certificate (enroll, renew, revoke, update, recov", - "content": "Request workflow\n\n Each Request has the same lifecycle described by the following figure.\n\n Figure 1. Request Workflow\n\n Requester\n\n A requester is someone who is granted the permission to request a certificate (enroll, renew, revoke, update, recover).\n\n Approver\n\n An approver is someone who is granted the permission to approve a request (enroll, renew, revoke, update, recover). An approver cannot approve its own request.\n\n Owner\n\n A request owner is someone who is designated as the benefactor for the request. It can view the request like the requester (in the My requests drawer), but unlike the requester, they can also access the certificate information (PKCS#12, challenge password).\n\n The owner is computed according to the following rules:\n\n enroll, update, migrate : the owner is the one defined in the request template (ownership tab)\n\n renew : the owner of the request is the owner of the renewed certificate\n\n recover : the owner is the requester of the recover request\n\n revoke : no owner is associated with the request\n\n Table 1. Owner vs Requester\n\n User type\n Can view the request\n Can view the PKCS#12\n Can view the challenge password\n\n Requester\n\n Yes\n\n No\n\n No\n\n Owner\n\n Yes\n\n Yes\n\n Yes\n\nAny user with the Enroll API/ Renew API permission can access the PKCS#12 or the challenge password for the workflow regardless of ownership status\n\n User guide\n How to enroll a certificate using the WebRA", - "keywords": [ - "request", - "workflow", - "user-guide", - "user-guide/webra/workflow", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:ca", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Certification Authorities", - "section": "admin-guide", - "slug": "admin-guide/ca", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/ca.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/ca.html", - "breadcrumbs": ["Horizon", "Admin guide", "Certification Authorities"], - "summary": "Certification Authorities ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure the Certification Authorities known by EverTrust Horizon. Prerequisites Certification Authorities will be needed beforeha", - "content": "Certification Authorities\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure the Certification Authorities known by EverTrust Horizon.\n\n Prerequisites\n\n Certification Authorities will be needed beforehand, in one of these formats:\n\n Certificate file (PEM or DER).\n\n Certificate string (PEM).\n\n You might also need the URL of the CRL issued by the CA, and/or the URL of the OCSP Responder for that CA.\n\n How to configure a Certification Authority\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Certification Authorities from the drawer or card: Certification Authorities .\n\n 3. Click on .\n\n Certificate Tab:\n\n 4. Either\n\n Fill in the certificate section with certificate string (PEM) OR\n\n Import the certificate file (PEM or DER).\n\n Then click on the next button.\n\n Details Tab:\n\n 5. Check the information from your CA certificate. Then click on the next button.\n\n Configuration Tab:\n\n 6. Fill in the information you want to add.\n\n Name * (string input) :\n\nEnter a meaningful certificate authority name. It must be unique for each certificate authority.\n\n OCSP responder URL (string) :\n\nURL to request an OCSP responder.\n\n CRL URL (string) :\n\nURL to download the CA CRL.\n\n Refresh Period ( finite duration ) :\n\nCRL or OCSP Refresh Period. Must be a valid finite duration.\n\n Timeout ( finite duration ) :\n\nConnection timeout when reaching CRL or OCSP. Must be a valid finite duration.\n\n Proxy (option) :\n\nThe HTTP/HTTPS proxy to use to reach the CRL or the OCSP Responder, if any.\n\n Is trusted for server authentication (boolean) :\n\nTells whether the CA should be trusted for server authentication, aka SSL/TLS server trust. The default value is set to false.\n\n Is trusted for client authentication (boolean) :\n\nTells whether the CA should be trusted for client authentication. The default value is set to false.\n\n Outdated Revocation Status Policy (option) :\n\nSelect \"Revoked\" if you want all certificates to be handled as revoked if the CRL/OCSP are unavailable. Select \"Last available status\" if you want Horizon to use the last available revocation status for the certificates.\n\n 7. Click on the import button.\n\n You can edit , download or delete the Certification Authorities.\n\n You will not be able to delete a Certification Authority if it is referenced in any other configuration element.\nPay also attention that the CA might be used (e.g. for TLS trust chain building), even if it is not explicitly referenced in configuration items.\n\n User Information\n PKI Queue", - "keywords": [ - "certification", - "authorities", - "admin-guide", - "admin-guide/ca", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:aws", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "AWS PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/aws", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/aws.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/aws.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "AWS" - ], - "summary": "AWS PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites You need to create a user using AWS IAM, and give it the AWSCertificateManagerPrivateCAUser right. You need to retrieve the Private CA ARN from ACM Private CA cons", - "content": "AWS PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n You need to create a user using AWS IAM, and give it the AWSCertificateManagerPrivateCAUser right.\n\n You need to retrieve the Private CA ARN from ACM Private CA console.\n\n Refer to the editor’s documentation to configure the PKI side here .\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n AWS Region * (string input) :\n\nAWS region to use.\n\n AWS PCA ARN * (string input) :\n\nAmazon Resource Name (ARN) is a file naming convention used to identify a particular resource in AWS public cloud. To be retrieved from AWS ACM Console.\n\n AWS PCA Template ARN (string input) :\n\nA template is a declaration of the AWS resources that make up a stack. The default value is set to: arn:aws:acm-pca:::template/EndEntityCertificate/V1 .\n\n AWS PCA Role ARN (string input)\n\n Certificate Policy OID (string input) :\n\nAn identifying number, in the form of an \"object identifier\" that is included in the certificatePolicies field of a certificate.\n\n Certificate signing hash (string multiple) :\n\nSelect the hash function that will be used.\n\n Certificate Usage (string multiple) :\n\nSelect the certificate usage.\n\n Number of valid days ( finite duration ) :\n\nCertificate validity duration in days. Must be in valid finite duration.\nThe default value is set to 365 days.\n\n Retry Interval ( finite duration ) :\n\nPredefined interval of time before retrying to retrieve the certificate from AWS. Must be in valid finite duration.\nThe default value is set to 3 seconds.\n\n 9. Click on the next button\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n AWS user access key ID (string input) :\n\nFind AWS Account and Access Keys.\n\n AWS user secret key (string input) :\n\nMust be set only if and only if AWS user access key ID is set.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the AWS PKI connector.\n\n General Information\n CertEurope", - "keywords": [ - "aws", - "pki", - "admin-guide", - "admin-guide/connectors/aws", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:certeurope", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "CertEurope PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/certeurope", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/certeurope.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/certeurope.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "CertEurope" - ], - "summary": "CertEurope PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites A technical account should be created. This technical account must have permissions to enroll and revoke SSL certificates on the desired domain(s). Limitati", - "content": "CertEurope PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n A technical account should be created.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired domain(s).\n\n Limitations\n\n Only the following fields are managed: commonName and subjectAltName DNS .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in CCS for the given \"Offer Identifier\", the exceeding items will be ignored.\n\n All limitations induced by the use of the CCS REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Endpoint URL to the CSS partner API * (string input) :\n\nURL to access the CertEurope web service API.\n\n Technical account login * (string input) :\n\nLogin of the technical account created in CCS, usually an email address.\n\n Technical account password * (string input) :\n\nPassword of the technical account created in CCS.\n\n CCS offer identifier * (string input) :\n\nThe identifier of the offer within CCS.\n\n Organization ID * (string input) :\n\nCustomer organization ID. For French companies, it’s usually the \"SIREN\".\n\n Revocation reason (string select) :\n\nSelect from the drop down the default revocation reason.\n\n Interval before retrying to retrieve certificate ( finite duration ) :\n\nThe default value is set to 21 seconds.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import) :\n\nPKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the CertEurope PKI connector.\n\n AWS\n CS-Novidy’s TrustKey", - "keywords": [ - "certeurope", - "pki", - "admin-guide", - "admin-guide/connectors/certeurope", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:csnovidy", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "CS-Novidy’s TrustyKey PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/csnovidy", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/csnovidy.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/csnovidy.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "CS-Novidy’s TrustKey" - ], - "summary": "CS-Novidy’s TrustyKey PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites A technical account should be created. This technical account must have permissions to enroll and revoke SSL certificates on the desired certific", - "content": "CS-Novidy’s TrustyKey PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n A technical account should be created.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired certificate profiles.\n\n An authentication and a signature certificate must be issued under as PKCS#12 files for this account.\n\n Limitations\n\n Only the following fields are managed: commonName (as mail_lastname), contactEmail (as mail_email), OU (as org_unit), O (as corp_company), C (as country), UID (as employeeID), subjectAltNames DNS and msUPN .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in TrustyKey for the given PGC , the exceeding items will be ignored.\n\n All limitations induced by the use of the TrustyKey CMP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n API endpoint URL * (string input) :\n\nURL to access the CS-Novidy’s TrustyKey web service.\n\n PGC * (string input) :\n\nEnter name of the PGC to be used.\n\n TrustyKey PKI server DN * (string input) :\n\nEnter the DN of the TrustyKey PKI server, starting from the CN.\n\n TrustyKey PKI server Certificate * (string input) :\n\nEnter the PEM representing the certificate of the CA issuing the certificates.\n\n CN mapping (string input) :\n\nEnter a CN to be mapped.\n\n Email mapping (string input) :\nEnter an email address or domain to be mapped.\n\n SAN DNS mapping (string input) :\n\nEnter a SAN DNS to be mapped.\n\n Profile mapping (string input) :\n\nEnter a profile to be mapped.\n\n Issuer mapping (string input) :\n\nEnter an issuer to be mapped.\n\n Legacy CMP Style (boolean)\n\nChose whether to use the legacy CMP style.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n Signer PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the signature certificate used to sign the CMP messages.\n\n Signer certificate password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the CS-Novidy’s TrustyKey PKI connector.\n\n CertEurope\n Digicert CertCentral", - "keywords": [ - "cs-novidy", - "trustykey", - "pki", - "admin-guide", - "admin-guide/connectors/csnovidy", - "horizon", - "admin", - "guide", - "pkis", - "connectors", - "trustkey" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:digicert", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "DigiCert CertCentral PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/digicert", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/digicert.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/digicert.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Digicert CertCentral" - ], - "summary": "DigiCert CertCentral PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites You need to validate the domain(s) for which you will issue certificates prior to their issuance. This can be done in DigiCert CertCentral in the ", - "content": "DigiCert CertCentral PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n You need to validate the domain(s) for which you will issue certificates prior to their issuance. This can be done in DigiCert CertCentral in the Certificates > Domains menu.\n\n You need to retrieve the organizationId from DigiCert CertCentral in the Certificates > Organizations menu.\n\n You need to generate an API Key in DigiCert CertCentral using the Account > Account Access menu.\n\n Limitations\n\n Only the following fields are managed: commonName and subjectAltName DNS and RFC822Name .\n\n For multi-valued fields (SAN DNS and RFC822Name ), if more data items are provided than configured in DigiCert CertCentral for the given type of certificate, the exceeding items will be ignored.\n\n All limitations induced by the use of the DigiCert CertCentral REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n DigiCert CertCentral API endpoint * (string input or select) :\n\nURL to access DigiCert CertCentral API along with the certificate type to issue. To do so you can select from the drop down menu or type in your \"certificate offer\" value, then press \"Enter\" the corresponding URL will be automatically fetched.\n\n DigiCert CertCentral Customer Organization ID * (int) :\n\nEnter customer organization ID.\n\n DigiCert CertCentral CA Cert ID (int) :\n\nEnter CA Cert ID, to be used for private CA only.\n\n Interval before retrying to retrieve certificate ( finite duration ) :\n\nUse for private CA only.\nThe default value is set to 9 seconds.\n\n Skip Approval (boolean) :\n\nThe default value is set to false.\n\n 9. Click on the next button.\n\n Custom tab\n\n 10. Click on if custom data mapping is needed.\n\n 11. Fill in the PKI-custom data mapping:\n\n Custom data field * (string input) :\n\n Label field * (select) :\n\nAny existing Horizon Label\n\n 12. Click on the next button.\n\n Authentication tab\n\n 13. Fill in the PKI-authentication fields:\n\n DigiCert CertCentral API Key * (string input) :\n\nEnter the API Key.\n\n 14. Click on the save button.\n\n You can edit , duplicate or delete the DigiCert CertCentral PKI connector.\n\n CS-Novidy’s TrustKey\n EJBCA", - "keywords": [ - "digicert", - "certcentral", - "pki", - "admin-guide", - "admin-guide/connectors/digicert", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:ejbca", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "EJBCA PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/ejbca", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/ejbca.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/ejbca.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "EJBCA" - ], - "summary": "EJBCA PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites A certificate profile should be created, e.g. reusing the default \"SERVER\" certificate profile. An authentication certificate should be issued for Horizon, and i", - "content": "EJBCA PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n A certificate profile should be created, e.g. reusing the default \"SERVER\" certificate profile.\n\n An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned certificate procedure.\n\n Limitations\n\n Only the following fields are managed: all Subject DN fields and subjectAltNames DNS, IPaddress, RFC822Name, msUPN and msGUID .\n\n For multi-valued fields (SAN DNS and RFC822Name ), if more data items are provided than configured in EJBCA for the given End Entity profile, the exceeding items will be ignored.\n\n All limitations induced by the use of the EJBCA RA SOAP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n EJBCA RA URL * (string input) :\n\nEnter SOAP endpoint URL of the EJBCA WebService.\n\n EJBCA Certificate Profile Name * (string input) :\n\nEnter EJBCA Certificate Profile to map for certificate issuance.\n\n EJBCA CA Name * (string input) :\n\nEnter CA to use for certificate issuance.\n\n EJBCA End Entity Profile * (string input) :\n\nEnter EJBCA End Entity profile.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the EJBCA PKI connector.\n\n Digicert CertCentral\n Entrust Certificates Services", - "keywords": [ - "ejbca", - "pki", - "admin-guide", - "admin-guide/connectors/ejbca", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:entrust", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Entrust Certificate Services PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/entrust", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/entrust.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/entrust.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Entrust Certificates Services" - ], - "summary": "Entrust Certificate Services PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites A technical account should be created to be used with the API. This technical account must have permissions to enroll and revoke SSL certi", - "content": "Entrust Certificate Services PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n A technical account should be created to be used with the API.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired certificate profiles (superadmin role).\n\n Limitations\n\n Only the following fields are managed: commonName (as cn, for SMIME certs), contactEmail (as requester email address), OU (only one) and subjectAltName DNS (for SSL certs) and RFC822Name (for SMIME) .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in ECS for the given certificate type, the exceeding items will be ignored.\n\n All limitations induced by the use of the ECS REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Technical account API login * (string input) :\n\nEnter the login of the technical account API.\n\n Technical account API password * (string input) :\n\nEnter the password of the technical account API.\n\n Certificate Type (select) :\n\nSelect the Certificate Type to issue.\n\n Requester’s default email * (string input) :\n\nEnter the requester default email address.\n\n Requester’s name (string input) :\n\nEnter the requester name to register.\n\n Requester’s phone (string input) :\n\nEnter the requester phone to register.\n\n Certificate lifetime ( finite duration ) :\nEnter Certificate lifetime, in days. For SMIME_ENT it is the number of years.\nThe default value is set to 90 days.\n\n Client ID (int) :\n\nEnter Client ID.\nThe default value is set to 1.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Entrust Certificate Services PKI connector.\n\n EJBCA\n EverTrust Integrated CA", - "keywords": [ - "entrust", - "certificate", - "services", - "pki", - "admin-guide", - "admin-guide/connectors/entrust", - "horizon", - "admin", - "guide", - "pkis", - "connectors", - "certificates" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:fisid", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "FISId PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/fisid", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/fisid.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/fisid.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "FISId" - ], - "summary": "FISId PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI > PKI Connectors . 3. Click on . 4. Select the correct PK", - "content": "FISId PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n FISId endpoint URL * (string input) :\n\nURL to access the API.\n\n Template ID * (int) :\n\nEnter the template ID.\n\n Default owner ID * (string input) :\n\nEnter a default owner ID.\n\n Authentication domain ID * (int) :\n\nEnter an authentication domain ID.\n\n Owner groups (string input) :\n\nEnter one or several, separated by commas\n\n To delete after revocation (boolean) :\n\nThe default value is set to false.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n API Key * (string input) :\n\nEnter app key.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the FISId PKI connector.\n\n EverTrust Integrated CA\n GlobalSign Atlas", - "keywords": [ - "fisid", - "pki", - "admin-guide", - "admin-guide/connectors/fisid", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:globalsign_atlas", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "GlobalSign Atlas PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/globalsign_atlas", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/globalsign_atlas.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/globalsign_atlas.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "GlobalSign Atlas" - ], - "summary": "GlobalSign Atlas PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI > PKI Connectors . 3. Click on . 4. Select the", - "content": "GlobalSign Atlas PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Hash Algorithm (select) :\n\nSelect the hash algorithm for the certificate to be issue.\n\n API Key * (string input) :\n\nEnter the key that allows to authenticate against GlobalSign Atlas API.\n\n API Secret * (string input) :\n\nEnter the password used to secure the aforementioned API Key.\n\n Certificate Usage (select) :\n\nSelect a usage from the drop down list.\n\n Retry Interval ( finite duration ) :\n\nThe default value is set to 3 seconds.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 10. Click on the save button.\n\n You can edit , duplicate or delete the GlobalSign Atlas PKI connector.\n\n FISId\n GlobalSign MSSL", - "keywords": [ - "globalsign", - "atlas", - "pki", - "admin-guide", - "admin-guide/connectors/globalsign_atlas", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:globalsign_mssl", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "GlobalSign MSSL PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/globalsign_mssl", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/globalsign_mssl.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/globalsign_mssl.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "GlobalSign MSSL" - ], - "summary": "GlobalSign MSSL PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites A technical account should be created. This technical account must have permissions to enroll and revoke SSL certificates on the desired domain. Limita", - "content": "GlobalSign MSSL PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n A technical account should be created.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired domain.\n\n Limitations\n\n Only the following fields are managed: contactEmail and subjectAltName DNS .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in GlobalSign MSSL for the given \"Product\", the exceeding items will be ignored.\n\n All limitations induced by the use of the GlobalSign MSSL SOAP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n GlobalSign endpoint * (string select) :\n\nSelect from the drop-down list: the value must be \"prod\" for GlobalSign Production endpoint or \"test\" for the test environment.\n\n GlobalSign profile ID * (string input) :\n\nTo be retrieved from the URL in the GlobalSign MSSL console.\n\n GlobalSign domain ID * (string input) :\n\nThe ID of the domain to manage. Displayed in the GlobalSign MSSL console.\n\n Certificate validity (int input) :\n\nCertificate validity in months.\n\n Default email address (string input) :\n\nChoose a default email address.\n\n Default phone number (string input) :\n\nChoose a default phone number.\n\n Interval before retrying to retrieve certificate ( finite duration ) :\n\nThe default value is set to 9 seconds.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Technical account username * (string input) :\n\nUsername of the technical account created in GlobalSign MSSL.\n\n Technical account password * (string input) :\n\nPassword of the technical account created in GlobalSign MSSL.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the GlobalSign MSSL PKI connector.\n\n GlobalSign Atlas\n MetaPKI", - "keywords": [ - "globalsign", - "mssl", - "pki", - "admin-guide", - "admin-guide/connectors/globalsign_mssl", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:integrated", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "EverTrust integrated CA", - "section": "admin-guide", - "slug": "admin-guide/connectors/integrated", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/integrated.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/integrated.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "EverTrust Integrated CA" - ], - "summary": "EverTrust integrated CA ⚠ Deprecated: This version reached LDOS on 28/09/2024. Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI > PKI Connectors . 3. Click on . 4. Select ", - "content": "EverTrust integrated CA\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Certificate Type * (select) :\n\nSpecify the certificate type to issue.\n\n Signing algorithm * (select) :\n\nSpecify the signing algorithm.\n\n CA Certificate (string input) :\n\nEnter CA certificate.\n\n CA Key (string input) :\n\nEnter CA key.\n\n CRL save path (string input) :\n\nPath to save the CRL on the Horizon server.\n\n CRL lifetime ( finite duration ) :\n\nCRL lifetime in days. Must be a valid finite duration.\n\n Certificate Back Date ( finite duration ) :\n\nCertificate Back Date. Must be a valid duration.\n\n Check Proof of Possession (boolean)\n\n 9. Click on the save button.\n\n You can edit , duplicate or delete the EverTrust integrated CA PKI connector.\n\n Entrust Certificates Services\n FISId", - "keywords": [ - "evertrust", - "integrated", - "ca", - "admin-guide", - "admin-guide/connectors/integrated", - "horizon", - "admin", - "guide", - "pkis", - "pki", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:metapki", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "MetaPKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/metapki", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/metapki.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/metapki.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "MetaPKI" - ], - "summary": "MetaPKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites Endpoint issuing CA Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI > PKI Connectors . 3. Cli", - "content": "MetaPKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n Endpoint issuing CA\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Endpoint * (string input) :\n\nThe MetaPKI Endpoint.\n\n Endpoint Issuing CA * (string select) :\n\nSelect the CA that will be issuing the certificates for this connector (from the imported Horizon CAs)\n\n Profile * (string input) :\n\nExample: Applications_Auth_Client_Serveur_SSL.\n\n Profile Cle * (string input) :\n\nExample: Serveur_SSL\n\n Workflow * (string input) :\n\nExample: S_LOCAL_SOFT\n\n Form Porteur Name (string input)\n\n Valid Days ( finite duration )\n\nCertificate lifetime in days (must be a valid finite duration).\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the MetaPKI PKI connector.\n\n GlobalSign MSSL\n MSAD Certificate Services", - "keywords": [ - "metapki", - "admin-guide", - "admin-guide/connectors/metapki", - "horizon", - "admin", - "guide", - "pkis", - "pki", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:msadcs", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Microsoft Active Directory Certificate Services PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/msadcs", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/msadcs.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/msadcs.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "MSAD Certificate Services" - ], - "summary": "Microsoft Active Directory Certificate Services PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites ADCS Connector installation guide must be completed prior to the configuration of this connector. Limitations All limit", - "content": "Microsoft Active Directory Certificate Services PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n ADCS Connector installation guide must be completed prior to the configuration of this connector.\n\n Limitations\n\n All limitations induced by the use of ADCS.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Endpoint * (string input) :\n\nURL to access the Web Enrollment ADCS component.\n\n Active Directory Domain Netbios Name * (string input) :\n\nThe Active Directory domain where to find the technical user and the ADCS server.\n\n Profile * (string input) :\n\nIt is recommended to duplicate default template, and grant the enrolment permissions to the created technical user. Example: Web Server\n\n CA Config * (string input) :\n\nThe CaConfig string, as given out by certutil -config for the considered ADCS CA. It’s usually in the form <ADCS Hostname>\\<CA CommonName>\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Signer PKCS#12 * (import) :\n\nImport the PKCS#12 file containing the signature certificate used to sign the CMP messages.\n\n Sign certificate password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n Technical account MSUPN * (string input) :\n\nCreate a user that has certificate issuance, revocation and management permissions at CA level and for the relevant certificates template.\n\n Technical account password * (string input) :\n\nPassword associated with aforementioned defined user.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Microsoft Active Directory Certificate Services PKI connector.\n\n MetaPKI\n Nexus Certificate Manager", - "keywords": [ - "microsoft", - "active", - "directory", - "certificate", - "services", - "pki", - "admin-guide", - "admin-guide/connectors/msadcs", - "horizon", - "admin", - "guide", - "pkis", - "connectors", - "msad" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:nexus", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Nexus Certificate Manager PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/nexus", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/nexus.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/nexus.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Nexus Certificate Manager" - ], - "summary": "Nexus Certificate Manager PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites A certificate procedure and a token procedure should be created. An authentication certificate should be issued for Horizon, and it should be", - "content": "Nexus Certificate Manager PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n A certificate procedure and a token procedure should be created.\n\n An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned token procedure.\n\n Nexus Endpoint CA\n\n Limitations\n\n Only the following fields are managed: commonName, UID, OU, O, C and subjectAltNames DNS, IPaddress, RFC822Name and msUPN .\n\n For multi-valued fields (SAN DNS, RFC822Name and IP address), if more data items are provided than configured in Nexus CM Procedure, the exceeding items will be ignored.\n\n All limitations induced by the use of the Nexus CM SDK.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill all mandatory fields:\n\n Nexus CM DNS name * (string input) :\n\nURL to access the Nexus Certificate Manager.\n\n Nexus endpoint CA * (select) :\n\nSelect the endpoint CA.\n\n Nexus CM Certificate procedure name * (string input) :\n\nThe token procedure name to use.\n\nShould point to the appropriate certificate procedure, and must be on PKCS#10 format.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Nexus Certificate Manager PKI connector.\n\n MSAD Certificate Services\n OpenTrust PKI", - "keywords": [ - "nexus", - "certificate", - "manager", - "pki", - "admin-guide", - "admin-guide/connectors/nexus", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:otpki", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "OpenTrust PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/otpki", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/otpki.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/otpki.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "OpenTrust PKI" - ], - "summary": "OpenTrust PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites A certificate profile should be created. An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocati", - "content": "OpenTrust PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n A certificate profile should be created.\n\n An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned certificate profile.\n\n Limitations\n\n Only the following fields are managed: commonName, userID, serialNumber, organizationalUnit, organization, country, adminEmail or contactEmail, msCertTemplateName and subjectAltNames DNS, IPadress, RFC822Name, msUPN and msGUID .\n\n For multi-valued fields (SAN DNS, IP address and RFC822Name), if more data items are provided than configured in OTPKI 'certificate template name', the exceeding items will be ignored.\n\n All limitations induced by the use of the RA SOAP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n OTPKI RA Connector URL * (string input) :\n\nMust point to the \"RA\" connector URL.\n\n OTPKI Certificate template name * (string input) :\n\nThe OTPKI certificate template to use.\n\n OTPKI zone (string input) :\n\nSpecify a zone (if used).\n\n Contact email mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n SAN DNS mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n SAN Email mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n UID mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the OpenTrust PKI connector.\n\n Nexus Certificate Manager\n Sectigo CMS", - "keywords": [ - "opentrust", - "pki", - "admin-guide", - "admin-guide/connectors/otpki", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:connectors:sectigo", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Sectigo CMS PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/sectigo", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/connectors/sectigo.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/sectigo.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Sectigo CMS" - ], - "summary": "Sectigo CMS PKI ⚠ Deprecated: This version reached LDOS on 28/09/2024. Prerequisites For publicly trusted certificates, you need to validate the domain(s) for which you will issue certificates prior to their issuance. You need to retrieve t", - "content": "Sectigo CMS PKI\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Prerequisites\n\n For publicly trusted certificates, you need to validate the domain(s) for which you will issue certificates prior to their issuance.\n\n You need to retrieve the customerUri and the organizationId from Sectigo CMS.\n\n You need to create a technical account with appropriate permissions including the allow ssl auto approve permission. You need to set a password for the technical account.\n\n Limitations\n\n Only the subjectAltName DNS field is managed.\n\n The certificate Subject DN will be set to whatever is specified in the PKCS#10 CSR.\n\n All limitations induced by the use of the Sectigo CMS REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Customer URI * (string input) :\n\nEnter the Customer URI. An integer is expected.\n\n Organization ID * (int input) :\n\nEnter the Organization ID.\n\n Profile (Certificate Type) * (string input) :\n\nEnter the Profile (Certificate Type). An integer is expected.\n\n Retry interval ( finite duration ) :\n\nPredefined interval of time before retrying to retrieve the certificate from Sectigo. Must be a valid finite duration. No default value is set.\n\n Valid Days ( finite duration ) :\n\nCertificate validity duration in days. Must be a valid finite duration. No default value is set.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Login * (string input) :\n\nEnter your Sectigo CMS login.\n\n Password * (string input) :\n\nEnter your Sectigo CMS password.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Sectigo CMS PKI connector.\n\n OpenTrust PKI\n Local Accounts", - "keywords": [ - "sectigo", - "cms", - "pki", - "admin-guide", - "admin-guide/connectors/sectigo", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:discovery", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Discovery", - "section": "admin-guide", - "slug": "admin-guide/discovery", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/discovery.html", - "breadcrumbs": ["Horizon", "Admin guide", "Discovery"], - "summary": "Discovery ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure Discovery campaigns. An EverTrust Horizon Discovery campaign will contain all certificates discovered on a specific scope. A discovered c", - "content": "Discovery\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure Discovery campaigns. An EverTrust Horizon Discovery campaign will contain all certificates discovered on a specific scope.\n\n A discovered certificate can be:\n\n An unknown certificate.\n\n> All certificate information will be stored and this certificate will appear as an ' unmanaged ' certificate.\n\n An already discovered certificate (due to another Discovery campaign).\n\n> Discovery campaign metadata will be added to the existing certificate.\n\n A managed certificate.\n\n> Discovery campaign metadata will be added to the existing certificate.\n\n How to create a Discovery Campaign\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Discovery from the drawer or card: Discovery .\n\n 3. Click on .\n\n 4. Fill in all mandatory fields.\n\n General tab\n\n Campaign name * (string input) :\n\nEnter a meaningful Discovery campaign name.\n\n Description (string input) :\n\nEnter Discovery campaign description.\n\n Enabled (boolean) :\n\nEnable/Disable this Discovery campaign.\n\n Search (select) :\n\nSelect an authorization level to search this Discovery campaign.\n\n Feed (select) :\n\nSelect an authorization level to feed this Discovery campaign.\n\n Log event on success * (boolean) :\n\nEnable/Disable discovery event on success.\n\n Log event on failure * (boolean) :\n\nEnable/Disable discovery event on failure.\n\n Log event on warning * (boolean) :\n\nEnable/Disable discovery event on warning.\n\n Host tab\n\n Hosts (string input or int) :\n\nSpecify the target to scan. Can be hostname(s), IP address(es), IP range or CIDR address(es). It is possible to add several hostnames separated by commas.\n\n Port tab\n\n Ports (string input or int) :\n\nEnter the port(s) to scan on hosts. It is possible to add several ports separated by commas or to add a port range separated by an hyphen (ex : 1-1000 to go from 1 to 1000).\n\n Hosts and ports should only be set if you intend to perform a network scan using horizon-cli in order to discover the certificates. These parameters are ignored in all other discovery modes (local scan, third party import).\n\n 6. Click on the save button.\n\n You can edit , flush or delete the Discovery.\n\n How to flush a Discovery Campaign\n\n Flushing a Discovery campaign is the action to remove Discovery campaign reference from all discovered certificates.\n\n There are three different cases:\n\n If the certificate is not managed by Horizon (only discovered by a Discovery campaign) AND only referenced by the campaign you are willing to flush → The certificate will be removed from the Horizon database.\n\n If the certificate is not managed by Horizon but is referenced by at least another Discovery campaign → The certificate will NOT be removed from the database and only the Discovery metadata will be removed from the certificate.\n\n If the certificate is managed by Horizon → Only the Discovery metadata will be removed from the certificate.\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Discovery from the drawer or card: Discovery .\n\n 3. Click on .\n\n 4. Click on the Confirm button to perform the flush.\n\n Notifications\n ACME", - "keywords": [ - "discovery", - "admin-guide", - "admin-guide/discovery", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Introduction", - "section": "admin-guide", - "slug": "admin-guide/introduction", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/introduction.html", - "breadcrumbs": ["Horizon", "Admin guide", "Introduction"], - "summary": "Introduction ⚠ Deprecated: This version reached LDOS on 28/09/2024. Description Horizon is EverTrust’s Certificate lifecycle management solution and is powered up by: Akka BouncyCastle MongoDB Kamon Play! Framework Scala NGINX Vue.js Quasar", - "content": "Introduction\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Description\n\n Horizon is EverTrust’s Certificate lifecycle management solution and is powered up by:\n\n Akka\n\n BouncyCastle\n\n MongoDB\n\n Kamon\n\n Play! Framework\n\n Scala\n\n NGINX\n\n Vue.js\n\n Quasar\n\n This document is specific to Horizon version 2.2 .\n\n Scope\n\n This document is an administration guide detailing how to configure and operate Horizon.\n\n Out of Scope\n\n This document does not describe how to install and bootstrap a Horizon instance. Please refer to the installation guide for installation related tasks.\n\n Troubleshooting\n User Information", - "keywords": [ - "introduction", - "admin-guide", - "admin-guide/introduction", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:notifications", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Notifications", - "section": "admin-guide", - "slug": "admin-guide/notifications", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/notifications.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/notifications.html", - "breadcrumbs": ["Horizon", "Admin guide", "Notifications"], - "summary": "Notifications ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section explains how to configure notifications in Horizon. Horizon currently supports 2 types of notifications : mail notifications and instant messaging notificatio", - "content": "Notifications\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section explains how to configure notifications in Horizon.\nHorizon currently supports 2 types of notifications : mail notifications and instant messaging notifications.\n\n Email Notifications\n\n This section details how to configure the email notifications.\n\n How to create a mail notification\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access emails from the drawer or card: Notifications > Emails .\n\n 3. Click on .\n\n 4. Fill in all mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful mail notification name.\n\n Event type * (select) :\n\nSelect the event type to notify (certificate or request).\n\n Event * (select) :\n\nSelect the event to notify.\n\n Retries in case of error (int) :\n\nSelect the number of times Horizon should retry to send the notification in case of error. The default value is set to 10.\n\n From *: (string input)\n\nEnter the email address that will appear in the email \"From\" field.\n\n To *: (select multiple & input multiple)\n\nSelect one or several recipients. You may also enter an email address.\n\n Subject * (string input) :\n\nEnter the email subject. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon email generation.\n\n Body * (string input) :\n\nEnter the email body. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon email generation.\n\n Is HTML (boolean) :\n\nSets whether the email body contains HTML code (true) or plain text (false). The default value is set to false.\n\n You can click on the \"+\" next to \"How to use dynamic attributes\" in order to get a range of possibilities from which one or more may be chosen.\n\n In case you selected any Certificate type event any Request type event but the Enroll requests ones:\n\n Attachments (list) :\n\nSets whether to attach the certificate to the email notification and which format to use for the attached certificate (if any).\n\n Attach certificate (PEM) attaches the certificate under PEM format\n\n Attach bundle (PEM) attaches the certificate as well as the entire trust chain used to sign it in PEM format\n\n Attach certificate (PKCS#7) attaches the certificate under PKCS#7 format\n\n Attach bundle (PKCS#7) attaches the certificate as well as the entire trust chain used to sign it in PKCS#7 format\n\n Attach certificate (DER) attaches the certificate under DER format\n\n In case you selected *Certificate Expiration* :\n\n Duration before certificate expiration causing the notification * ( finite duration ) :\n\nSets how long before certificate expiration the email notification should be sent. The default value is set to 5 days.\n\n Run on renewed (boolean) :+\nSets whether the expiration notification should be sent even though the certificate has been renewed. Default value is set to false (if the certificate has been renewed, the notification will not be sent).\n\n In case you selected as an Event Enroll request Approval or Recover request Approval :\n\n Attach PKCS#12 (set at false) (boolean) :\n\nSets whether the certificate in PKCS#12 format (certificate + private key encrypted by password) should be attached to the email. The default value is set to false.\n\n Send email if (select unique) :\n\nSelect either Always - Centralized (Horizon generates the private key) - Decentralized (a CSR is provided to Horizon). The default value is set to Always.\n\n In case you selected as an Event Enroll request Pending or Revoke request Pending or Recover request Pending or Update request Pending or Migrate Request Pending :\n\n Duration after request submission causing the notification * ( finite duration ) :\n\nDuration after request submission causing the notification to be sent, in case the request was not approved in the meantime. The default value is set to 5 days.\n\n 6. Click on the save button.\n\n You can edit , duplicate or delete the Email Notification .\n\n Messaging\n\n This section details how to configure the messaging notifications.\n\n Prerequisites\n\n You will need a webhook URL from the messaging tools in order to send notification.\n\n How to create a Messaging notification\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Messaging from the drawer or card: Notifications > Messaging .\n\n 3. Click on .\n\n 4. Fill in all mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful email notification name.\n\n Event type * (select) :\n\nSelect the event type to notify (certificate or request).\n\n Event * (select) :\n\nSelect the event to notify.\n\n Retries in case of error (int) :\n\nSelect the number of times Horizon should retry to send the notification in case of error.The default value is set to 10.\n\n Timeout * ( finite duration ) :\n\nThe time before Horizon stop trying to connect to Webhook or Proxy.\n\n Proxy (option) :\n\nThe HTTP/HTTPS proxy to use to reach the messaging tool, if any.\n\n To * (select) :\n\nSelect one of:\n\n Static\n\n Teams webhook\n\n Title * (string input) :\n\nEnter the title of the instant messaging. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon notification generation.\n\n Body * (string input) :\n\nEnter the body of the instant messaging. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon notification generation.\n\n You can click on the \"+\" next to \"How to use dynamic attributes\" in order to get a range of possibilities from which one or more may be chosen.\n\n In case you selected as an Event Certificate Expiration :\n\n Duration before certificate expiration causing the notification * ( finite duration ) :\n\nSets how long before certificate expiration the messaging notification should be sent. The default value is set to 5 days.\n\n In case you selected as an Event Enroll request Pending or Revoke request Pending or Recover request Pending or Update request Pending or Migrate request Pending :\n\n Duration after request submission causing the notification * ( finite duration ) :\n\nDuration after request submission causing the messaging notification to be sent, in case the request was not approved in the meantime. The default value is set to 5 days.\n\n 6. Click on the save button.\n\n You can edit , duplicate or delete the Messaging Notification.\n\n Teams\n Discovery", - "keywords": [ - "notifications", - "admin-guide", - "admin-guide/notifications", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:other:cron", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Cron Expression", - "section": "admin-guide", - "slug": "admin-guide/other/cron", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/other/cron.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/other/cron.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Common configuration elements", - "Cron Expression" - ], - "summary": "Cron Expression ⚠ Deprecated: This version reached LDOS on 28/09/2024. Cron expressions are composed of 6 required fields and one optional field separated by white spaces. The fields are respectively described as follows: Field Name Allowed", - "content": "Cron Expression\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Cron expressions are composed of 6 required fields and one optional field separated by white spaces. The fields are respectively described as follows:\n\n Field Name\n Allowed Values\n Allowed Special Character\n\n Seconds\n\n 0-59\n\n - * /\n\n Minutes\n\n 0-59\n\n - * /\n\n Hours\n\n 0-23\n\n - * /\n\n Day-of-month\n\n 1-31\n\n - * ? / L W\n\n Month\n\n 1-12 or JAN-DEC\n\n - *\n\n Day-of-Week\n\n 1-7 or SUN-SAT\n\n - * ? / L #\n\n Year (Optional)\n\n empty, 1970-2199\n\n - * /\n\n Special characters\n\n * (\"all values\") - used to select all values within a field. For\nexample, \"*\" in the minute field means every minute .\n\n ? (\"no specific value\") - useful when you need to specify something\nin one of the two fields in which the character is allowed, but not the\nother. For example, if I want my trigger to fire on a particular day of\nthe month (say, the 10th), but don’t care what day of the week that\nhappens to be, I would put \"10\" in the day-of-month field, and \"?\" in\nthe day-of-week field. See the examples below for clarification.\n\n - - used to specify ranges. For example, \"10-12\" in the hour field\nmeans \"the hours 10, 11 and 12\".\n\n , - used to specify additional values. For example, \"MON,WED,FRI\" in\nthe day-of-week field means \"the days Monday, Wednesday, and Friday\".\n\n / - used to specify increments. For example, \"0/15\" in the seconds\nfield means \"the seconds 0, 15, 30, and 45\". And \"5/15\" in the seconds\nfield means \"the seconds 5, 20, 35, and 50\". You can also specify '/'\nafter the '*' character - in this case '*' is equivalent to having '0'\nbefore the '/'. '1/3' in the day-of-month field means \"fire every 3 days\nstarting on the first day of the month\".\n\n L (\"last\") - has different meaning in each of the two fields it is allowed\ninto. For example, the value \"L\" in the day-of-month\nfield means \"the last day of the month\" - day 31 for January, day 28 for\nFebruary on non-leap years. If used in the day-of-week field by itself,\nit simply means \"7\" or \"SAT\". But if used in the day-of-week field after\nanother value, it means \"the last xxx day of the month\" - for example\n\"6L\" means \"the last Friday of the month\". You can also specify an\noffset from the last day of the month, such as \"L-3\" which would mean\nthe third-to-last day of the calendar month. When using the 'L' option,\nit is important not to specify lists, or ranges of values, as you’ll get\nconfusing/unexpected results.\n\n W (\"weekday\") - used to specify the weekday (Monday-Friday) nearest\nthe given day. As an example, if you were to specify \"15W\" as the value\nfor the day-of-month field, the meaning is: \"the nearest weekday to the\n15th of the month\". So if the 15th is a Saturday, the trigger will fire\non Friday the 14th. If the 15th is a Sunday, the trigger will fire on\nMonday the 16th. If the 15th is a Tuesday, then it will fire on Tuesday\nthe 15th. However if you specify \"1W\" as the value for day-of-month, and\nthe 1st is a Saturday, the trigger will fire on Monday the 3rd, as it\nwill not 'jump' over the boundary of a month’s days. The 'W' character\ncan only be specified when the day-of-month is a single day, not a range\nor list of days.\n\n # - used to specify \"the nth\" XXX day of the month. For example, the\nvalue of \"6#3\" in the day-of-week field means \"the third Friday of the\nmonth\" (day 6 = Friday and \"#3\" = the 3rd one in the month). Other\nexamples: \"2#1\" = the first Monday of the month and \"4#5\" = the fifth\nWednesday of the month. Note that if you specify \"#5\" and there is not 5\nof the given day-of-week in the month, then no firing will occur that\nmonth.\n\n The 'L' and 'W' characters can also be combined\nin the day-of-month field to yield ' LW ', which translates to \"last\nweekday of the month\" .\n\n HTTP Proxy\n Finite Duration", - "keywords": [ - "cron", - "expression", - "admin-guide", - "admin-guide/other/cron", - "horizon", - "admin", - "guide", - "common", - "configuration", - "elements" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:other:duration", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Finite Duration", - "section": "admin-guide", - "slug": "admin-guide/other/duration", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/other/duration.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/other/duration.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Common configuration elements", - "Finite Duration" - ], - "summary": "Finite Duration ⚠ Deprecated: This version reached LDOS on 28/09/2024. The format of a Finite Duration is \"<length><unit>\" , where: White space is allowed between the parts. Length is a positive integer without the \"+\" sign. Val", - "content": "Finite Duration\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n The format of a Finite Duration is \"<length><unit>\" , where:\n\n White space is allowed between the parts.\n\n Length is a positive integer without the \"+\" sign.\n\n Valid possible units are described in the below table:\n\n Unit\n Short name\n Long names\n\n DAYS\n\n d\n\n day days\n\n HOURS\n\n h\n\n hour hours\n\n MINUTES\n\n m\n\n min mins minute minutes\n\n SECONDS\n\n s\n\n sec secs second seconds\n\n MILLISECONDS\n\n ms\n\n milli millis millisecond milliseconds\n\n For example, 10 seconds will be written as \"10 s\", \"10s\", \"10 sec\" or \"10 seconds\".\n\n Cron Expression\n Reports", - "keywords": [ - "finite", - "duration", - "admin-guide", - "admin-guide/other/duration", - "horizon", - "admin", - "guide", - "common", - "configuration", - "elements" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:pki_admin", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "PKI Connectors", - "section": "admin-guide", - "slug": "admin-guide/pki_admin", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/pki_admin.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/pki_admin.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "General Information" - ], - "summary": "PKI Connectors ⚠ Deprecated: This version reached LDOS on 28/09/2024. Description A \"PKI Connector\" is a configuration piece that allows to establish the communication with any supported PKI. Additionally, it enables to map a specific certi", - "content": "PKI Connectors\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Description\n\n A \"PKI Connector\" is a configuration piece that allows to establish the communication with any supported PKI. Additionally, it enables to map a specific certificate profile within the connected PKI.\n\n Common prerequisites\n\n To grant \"Horizon\" proper access to a given PKI, three categories of requirements must be gathered:\n\n Credentials : It could be either certificates (PKCS#12 format) or technical accounts (login/password) allowing to authenticate against the PKI API.\n\n Permissions : The credentials must be granted with the proper permissions on the PKI in order to be able to manage certificate lifecycle (enroll, revoke, renew).\n\n Profile/Certificate information : This information is used to map certificate types and/or certificate fields.\n\n PKI Queue\n AWS", - "keywords": [ - "pki", - "connectors", - "admin-guide", - "admin-guide/pki_admin", - "horizon", - "admin", - "guide", - "pkis", - "general", - "information" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:pki_queue", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "PKI Queue", - "section": "admin-guide", - "slug": "admin-guide/pki_queue", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/pki_queue.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/pki_queue.html", - "breadcrumbs": ["Horizon", "Admin guide", "PKIs", "PKI Queue"], - "summary": "PKI Queue ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure a PKI Queue. PKI Queue are used to limit the PKI requests (enrollment, revocation) PKI Queue Configuration 1. Log in to Horizon Administr", - "content": "PKI Queue\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure a PKI Queue. PKI Queue are used to limit the PKI requests (enrollment, revocation)\n\n PKI Queue Configuration\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI Queues from the drawer or card: PKI > PKI Queues .\n\n 3. Click on .\n\n 4. Fill in the fields:\n\n Name * (string input) :\n\nChoose a meaningful queue name. It must be unique.\n\n Description (string input) :\n\nThe description for the PKI Queue.\n\n Throttle Parallelism (int input) :\n\nNumber of requests processed at the same time.\n\n Throttle Duration ( finite duration ) :\n\nMaximum requests processed at the same time in a given duration. Parallelism must be set.\n\n Max Size * (int input) :\n\nMaximum requests stored in the queue\n\n Cluster Wide (boolean) :\n\nIf not enabled, then the throttleParallelism and throttleDuration will be the same for all nodes in the cluster.\nIf enabled, then the throttleParallelism and throttleDuration is generalized for all clusters.\n\n If the queue is full every new request will be discarded.\n\n Certification Authorities\n General Information", - "keywords": [ - "pki", - "queue", - "admin-guide", - "admin-guide/pki_queue", - "horizon", - "admin", - "guide", - "pkis" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:protocols", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Common configuration elements for profiles", - "section": "admin-guide", - "slug": "admin-guide/protocols", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/protocols.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "Common configuration elements for profiles" - ], - "summary": "Common configuration elements for profiles ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure sections that are common to all profiles Common configuration for profiles tab Common configuration for ", - "content": "Common configuration elements for profiles\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure sections that are common to all profiles\n\n Common configuration for profiles tab\n\n Common configuration for profiles\n\n Languages\n\n 1. Click on add button.\n\n 2. Fill in the mandatory fields.\n\n Language * (string input) :\n\nSelect a language.\n\n Display Name * (string input) :\n\nEnter a display name.\n\n Description (string input) :\n\nEnter a description.\n\n You can add more by clicking on the add button again or delete the language.\n\n Labels\n\n 1. Click on add button.\n\n 2. Fill in the mandatory fields.\n\n Element * (string input) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nTells whether the label is mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label is editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label. This value must comply with the value restriction.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Enter the label value and press \"enter\" to add this value to the accepted value list.\n\n Regex (string input) :\n\nThe label value will have to match the regex. Enter the regular expression en click on the check button to set the regex.\n\n You can delete or reorder (drag and drop) the label template.\n\n Owner Policy\n\n 1. Specify the request’s owner policy (only used in EST, SCEP and WEBRA prevalidated request).\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Team Policy\n\n 1. Specify the request’s team policy (only used in EST, SCEP and WebRA prevalidated request).\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist.\n\n Regex (string input) :\n\nThe team will have to match the regex. Enter the regular expression and click on the check button to set the regex.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Metadata policy (overridable metadata)\n\n==\nMetadata are used by Horizon or Third party connectors, updating them should be done with utmost care.\n==\n\n==\nThe contact email metadata default value is set to editable by the requester and the approver.\n==\n\n 1. Click on add button.\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n Authorization Levels\n\n 1. Select an authorization level for each workflow.\n\n *Everyone:\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live (TTL)\n\n 1. Enter a time for each request.\n\n Enrollment request * ( finite duration ) :\n\nMust be in valid finite duration. The default value is set to one hour.\n\n Revocation request * ( finite duration ) :\n\nMust be in valid finite duration. The default value is set to one hour.\n\n Update request * ( finite duration ) :\n\nMust be in valid finite duration. The default value is set to one hour.\n\n Migration request * ( finite duration ) :\n\nMust be in valid finite duration. The default value is set to one hour.\n\n Recover request ( finite duration ) :\n\nMust be in valid finite duration. This field is enabled when Private key escrowing is set to on (Specfic configuration tab > Crypto Policy).\n\n Constraints\n\n ACME, EST, SCEP and WCCE protocols.\n\n 1. Fill in the mandatory fields.\n\n RSA Minimal Key size (select) :\n\nSelect the allowed RSA key size(s).\n\n Allowed EC curves (select) :\n\nSelect the allowed elliptic curve algorithms.\n\n Allowed email domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n Allowed DNS domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n CSR Data Mapping\n\n 1. Click on add button.\n\n 2. Select a field and enter a value.\n\n You can add more by clicking on the add button again or delete the CSR Data Mapping.\n\n Notification\n\n Notifications configuration tab\n\n Prerequisites\n\n Mail , Messaging\n\n How to manage Notification for profiles\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n 1. Chose notifications to be sent on certificate event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a request:\n\n Enroll/Revocation/Update/Migrate request :\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n You can delete the Notification for profile.\n\n WebRA\n AWS Certificate Manager Integration", - "keywords": [ - "common", - "configuration", - "elements", - "for", - "profiles", - "admin-guide", - "admin-guide/protocols", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:protocols:acme", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "ACME", - "section": "admin-guide", - "slug": "admin-guide/protocols/acme", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/protocols/acme.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/acme.html", - "breadcrumbs": ["Horizon", "Admin guide", "Protocols", "ACME"], - "summary": "ACME ⚠ Deprecated: This version reached LDOS on 28/09/2024. Introduction This section details how to configure and consume the ACME protocol. Horizon implements an ACME service respecting the RFC 8555 and more specifically the following lif", - "content": "ACME\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Introduction\n\n This section details how to configure and consume the ACME protocol.\n\n Horizon implements an ACME service respecting the RFC 8555 and more specifically the following lifecycle workflows:\n\n Enrollment;\n\n Renewal (which is equivalent to an enrollment);\n\n Revocation.\n\n Managing certificate lifecycle through the ACME protocol involves up to three components:\n\n Horizon as the ACME endpoint;\n\n An asset executing an ACME client or directly integrating the ACME protocol;\n\n When ACME validation is ' dns-01 ', DNS server(s).\n\nACME validation modes will be detailed later on.\n\n The protocol paradigm can be described as follows: ' if the asset can prove it has authority on the DNS names (called identifiers in ACME) it is requesting for, the certificate should be automatically enrolled / renewed ', which is basically equivalent to a Domain Validation .\n\n The following schema is a simplified workflow of an ACME enrollment:\n\nThe protocol is based on the notion of challenge and offers three validation modes to actually verify challenges and prove that the asset owns authority on the requested DNS name(s), i.e. ACME identifiers:\n\n http-01 : For each requested identifier, Horizon will validate the challenge by connecting back in HTTP on the configured http-01 validation port (TCP/80 by default) and retrieve the response to the challenge;\n\n tls-alpn-01 : For each requested identifier, Horizon will validate the challenge by connecting back in HTTPS on the configured tls-alpn-01 validation port (TCP/443 by default) and extract the response to the challenge from an ALPN extension in the asset / client HTTPS response;\n\n dns-01 : For each requested identifier, Horizon will validate the challenge through a DNS request and look for a specific TXT entry containing the response corresponding to the challenge for the considered identifier.\n\n Therefore, validation modes have the following constraints:\n\n http-01 and tls-alpn-01 :\n\n Horizon must be able to access the asset on the validation port;\n\n The validation port must be available and opened on the asset;\n\n dns-01 : the ACME client must be configured with DNS credentials owning the permission to create TXT records on the requested domain(s).\n\nFor http-01 and tls_alpn-01 validation modes, it is possible to configure an HTTP proxy to proxify the ACME validation tentative(s). Using an HTTP proxy is useful when http-01 and/or tls-alpn-01 validation need to be performed on asset(s) hosted within a DMZ where incoming network streams must be limited. In this scenario, an HTTP proxy is configured to relay ACME validations coming from the Horizon nodes within the DMZ and a unique incoming stream needs to be open to allow communication from Horizon node to the HTTP proxy.\n\n The choice of the validation mode to use mainly depends on the architecture. Here are the EverTrust recommendations:\n\n If the requester is not the asset, prefer the dns-01 validation mode;\n\n If the requester is the asset:\n\n If the asset is reachable from Horizon nodes, prefer the http-01 ;\n\n If the asset is not reachable from Horizon nodes, prefer the dns-01 ;\n\n tls-alpn-01 is the most complicated validation mode to implement and therefore should only be used when no other validation mode is an option.\n\n Qualified ACME clients\n\n EverTrust qualifies the following ACME clients for any release of the Horizon product:\n\n Linux ACME clients:\n\n acme.sh\n\n certbot\n\n lego\n\n Windows ACME client:\n\n lego\n\n WinCertes : this open source client is developed and maintained by EverTrust, therefore officially supported\n\n Kubernetes: cert-manager\n\nIf an ACME client is not listed above, it does not necessarily mean that the client will not work with Horizon, only that the client is not included in the list of clients tested in Horizon’s continuous integration test cases.\n\n ACME Profile\n\n This section details how to configure an ACME Profile.\n\n Prerequisites\n\n On Horizon side, you need to set up:\n\n PKI Connector\n\n How to configure ACME Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access ACME Profile from the drawer or card: Protocols > ACME .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of a URL, it is advisable to use only lower case letters and dashes.\n\n Enabled * (boolean) :\n\nIndicates whether the profile is enabled or not. The default value is set to true.\n\n PKI Connector (select) :\n\nSelect a PKI connector previously created.\n\n Max certificate per holder (int) :\n\nIf specified, defines the maximum number of active certificates for a given Holder. If the number of active certificates exceeds this parameter, then the oldest certificate(s) above the limit will be automatically revoked.\n\n Validations\n\n Validation Methods (select) :\n\nSelect the authorized ACME validation method(s) on the considered profile ( HTTP-01 and/or TLS-ALPN-01 and/or DNS-01 ).\n\n HTTP_01 validation port (int) :\n\nHTTP port to perform the http-01 validation. The default value is set to 80.\n\n TLS-ALPN_01 validation port (int) :\n\nHTTPS port to perform the tls-alpn-01 validation. The default value is set to 443.\n\n Challenge verification attempts * (int) :\n\nSpecify the number of time Horizon should try to validate an ACME challenge. Th default value is set to 3.\n\n Challenge verification retry delay * ( finite duration ) :\n\nSpecify the time duration Horizon should wait between two consecutive validations for the same challenge. The default value is set to 3 seconds.\n\n Proxy (select) :\n\nSpecify an HTTP proxy to use when performing http-01 or tls-alpn-01 validations.\n\n Timeout * ( finite duration ) :\n\nSpecify the time duration Horizon should wait when performing http-01 , tls-alpn-01 or dns-01 validations.\n\n Requests management\n\n Authorized short name (boolean) :\n\nSpecify if using short name is authorized when requesting certificate. If set to yes, one verifiable FQDN must be requested for each specified short name. The default value is set to false.\n\n Authorized empty contact (boolean) :\n\nSpecify if an ACME account can be registered without specifying a contact email address. Default to false.\n\n Default contacts mail (string input multiple) :\n\nSpecify a list of default contact email addresses when registering an ACME account with no specified contact email address.\n\n Max DNS name (int) :\n\nIf specified, enforce the maximum number of requested DNS name(s).\n\n Meta\n\n Is required terms of service (boolean) :\n\nSpecify if explicitly agreeing to the terms of service is required when registering an ACME account. The default value is set to false.\n\n Terms of service (string input) :\n\nSpecify an URL identifying the current terms of service.\n\n Website (string input) :\n\nSpecify an HTTP or HTTPS URL locating a website providing more information about the ACME server.\n\n CAA Identities (string input) :\n\nThe hostnames that the ACME server recognizes as referring to itself for the purposes of CAA record validation as defined in RFC6844 .\n\n Self Permissions\n\n Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to revoke the certificate with no validation workflow. Set to false by default.\n\n Request Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request the revocation of the certificate. Set to false by default.\n\n Update (boolean) :\nSpecify whether the certificate’s owner is authorized to update the certificate with no validation workflow. The default value is set to false.\n\n Request Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request certificate’s update. The default value is set to false.\n\n You can further configure the profile using the Common configuration for profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the ACME Profile.\n\n You won’t be able to delete an ACME Profile if it is referenced somewhere else.\n\n ACME client usages\n\n This section details how to use the most common Linux and Windows ACME clients.\n\n Linux ACME clients\n\n This section details how to use the acme.sh and certbot ACME clients.\n\n Overview\n\n Certbot is able to run on any recent UNIX-like operating system equipped with Python 2.7 or 3.4+, while acme.sh can also run on any recent Linux distribution running either bash, dash or sh.\n\n They both fully support the latest ACMEv2 protocol including its main latest feature: wildcard certificates (*.example.com).\n\n Both clients supports different modes for obtaining a certificate and in some cases automatically installing it.\n\n The following tables lists the different modes for each clients:\n\n Modes\n certbot\n acme.sh\n Notes\n\n apache\n\n Y\n\n Y\n\n Obtains and automatically installs a certificate using the running Apache server. (For acme.sh, this mode will only obtain a certificate without installing it)\n\n nginx\n\n Y\n\n Y\n\n Obtains and automatically installs a certificate using the running NGINX server. (For acme.sh, this mode will only obtain a certificate without installing it)\n\n webroot\n\n Y\n\n Y\n\n Obtains a certificate by writing to the webroot directory of an already running web server\n\n standalone\n\n Y\n\n Y\n\n Uses a \"standalone\" web server managed by Certbot or acme.sh. This mode is useful on system with no web servers or if using the running web server is not desired\n\n DNS\n\n Y\n\n Y\n\n This mode automates obtaining a certificate by modifying a DNS record to prove the control over a domain\n\n tls-alpn\n\n N\n\n Y\n\n Uses a TLS server to validate the control over a domain\n\n Requesting a certificate\n\n Both clients must be started using administrative privileges ( sudo ), except for acme.sh when using the webroot or DNS modes.\n\n Each client requires only a few parameters to request a certificate.\n\n acme.sh parameters:\n\n Parameter\n Description\n\n -issue\n\n Obtain or renew a certificate, but does not install it\n\n -w [VALUE]\n\n Path of the server’s webroot folder\n\n -d [VALUE]\n\n The domain(s) to enroll.\n\n certbot parameters:\n\n Parameter\n Description\n\n certonly\n\n Obtain or renew a certificate, but does not install it\n\n –webroot\n\n Place files in a server’s webroot folder for authentication\n\n -w [VALUE]\n\n Path of the server’s webroot folder\n\n -d [VALUE]\n\n The domain(s) to enroll.\n\n Requesting a certificate for Apache using certbot:\n\n (sudo) certbot run --apache --no-eff-email --agree-tos --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -m <contact email address, example: [email protected] > --domain <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --apache : Enables the Apache mode\n\n --no-eff-email : Does not share your email address with EFF\n\n --agree-tos : Explicitly agrees to the terms of service\n\n --server : Horizon ACME profile endpoint\n\n -m : Contact email address\n\n --domain : Requested DNS name (can be specified several times)\n\n Requesting a certificate for nginx using certbot:\n\n (sudo) certbot run --nginx --no-eff-email --agree-tos --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -m <contact email address, example: [email protected] > --domain <DNS name, example: nginx.evertrust.fr>\n\n Where:\n\n --nginx : Enables the nginx mode\n\n --no-eff-email : Does not share your email address with EFF\n\n --agree-tos : Explicitly agrees to the terms of service\n\n --server : Horizon ACME profile endpoint\n\n -m : Contact email address\n\n --domain : Requested DNS name (can be specified several times)\n\n Requesting a certificate for nginx using acme.sh:\n\n (sudo) acme.sh --issue --nginx --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> --accountemail <contact email address, example: [email protected] > -d <DNS name, example: nginx.evertrust.fr>\n\n Where:\n\n --issue : Specifies that this is a certificate request\n\n --nginx : Enables the nginx mode\n\n --server : Horizon ACME profile endpoint\n\n --accountemail : Contact email address\n\n -d : Requested DNS name (can be specified several times)\n\n Requesting a certificate in standalone mode using certbot:\n\n (sudo) certbot certonly --standalone --no-eff-email --agree-tos --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -m <contact email address, example: [email protected] > --domain <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --standalone : Enables the standalone mode, i.e. certbot will start a local web server to server the response\n\n --no-eff-email : Does not share your email address with EFF\n\n --agree-tos : Explicitly agrees to the terms of service\n\n --server : Horizon ACME profile endpoint\n\n -m : Contact email address\n\n --domain : Requested DNS name (can be specified several times)\n\n Requesting a certificate in standalone mode using acme.sh:\n\n (sudo) acme.sh --issue --standalone --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> --accountemail <contact email address, example: [email protected] > -d <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --issue : Specifies that this is a certificate request\n\n --standalone : Enables the standalone mode, i.e. acme.sh will start a local web server to server the response\n\n --server : Horizon ACME profile endpoint\n\n --accountemail : Contact email address\n\n -d : Requested DNS name (can be specified several times)\n\n Revoking a certificate\n\n Revoking a certificate using certbot:\n\n (sudo) certbot revoke --cert-path <path of the certificate to revoke> --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory>\n\n Where:\n\n --cert-path : Specifies the path of the certificate to revoke\n\n --server : Horizon ACME profile endpoint\n\n Revoking a certificate using acme.sh:\n\n (sudo) acme.sh --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> --revoke -d <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --server : Horizon ACME profile endpoint\n\n -d : DNS name of the certificate to revoke\n\n Windows ACME clients\n\n This section details how to use the WinCertes ACME client.\n\n Overview\n\n WinCertes is a simple and efficient CLI-based client made to run on any Windows Server ( > Windows Server 2008 R2 SP1 (64 bits)) and running .NET 4.6.1 or higher.\n\n The client fully supports ACMEv2 including its latest feature, along with the support of wildcard certificates (*.example.com).\n\n WinCertes eases certificate installation and renewal by automatically binding them to the appropriate web site on IIS and by creating a Scheduled Task that will check the expiration date of the certificates and trigger a renewal if necessary.\n\n WinCertes offers the possibility to launch a PowerShell script upon the successful retrieval of a certificate. This feature enables advanced deployment on Exchange or multi-servers for instance.\n\n The client supports two validation modes for validating the identity of the certificate requester:\n\n HTTP challenge validation\n\n With the ability to support the running IIS web server or to use an embedded standalone web server for easier configuration.\n\n DNS challenge validation\n\n Support for Windows DNS Server\n\n Support for acme-dns\n\n Requesting a certificate\n\n To request a certificate using WinCertes, the Windows command line ( cmd.exe ) must be run as Administrator.\n\n Then WinCertes requires only a few parameters to request a certificate:\n\n Parameter\n Description\n\n -d [VALUE]\n\n The domain(s) to enroll\n\n -w\n\n toggle the local web server use and sets its ROOT directory (default c:\\inetpub\\wwwroot ).\n\nActivates HTTP validation mode.\n\n -b [VALUE]\n\n The name of the IIS web site to bind the certificate to\n\n -p\n\n Used to make WinCertes create a Scheduled Task to handle certificate renewal\n\n There are many more options to customize the requests to specific needs.\n\n Requesting a certificate for IIS using WinCertes:\n\n (as administrator) wincertes -s <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -w -b <IIS Site Name, example: \"Default Web Site\"> -p -e <contact email address, example: [email protected] > -d <DNS name, example: iis.evertrust.fr>\n\n Where:\n\n -s : Horizon ACME profile endpoint\n\n -w : Enables standalone mode, i.e. WinCertes will start a local web server to serve the response\n\n -b : IIS Web Site name\n\n -p : Registers a scheduled task to enable certificate automated renewal\n\n -e : Contact email address\n\n Discovery\n EST", - "keywords": [ - "acme", - "admin-guide", - "admin-guide/protocols/acme", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:protocols:est", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "EST", - "section": "admin-guide", - "slug": "admin-guide/protocols/est", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/protocols/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/est.html", - "breadcrumbs": ["Horizon", "Admin guide", "Protocols", "EST"], - "summary": "EST ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section refers to the EST protocol, as described by RFC 7030 . EST Profile This section details how to configure the EST Profile Prerequisites PKI How to configure EST Profile ", - "content": "EST\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section refers to the EST protocol, as described by RFC 7030 .\n\n EST Profile\n\n This section details how to configure the EST Profile\n\n Prerequisites\n\n PKI\n\n How to configure EST Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access EST Profile from the drawer or card: Protocol > EST .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon use the name to identify the profile.\n\n Enabled (boolean) :\n\nTells whether the profile is enabled or not.\nThe default value is set to true.\n\n PKI (select) :\n\nSelect a PKI Connector previously created.\n\n Max certificates per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Crypto Policy\n\n Decentralized enrollment (boolean) :\n\nTells whether the profile should be used with a decentralized enrollment mode, i.e CSR (PKCS#10) signing by the PKI.\nThe default value is set to true.\n\n Centralized enrollment (boolean) :\n\nTells whether the profile should be used with a centralized enrollment, i.e providing a PKCS#12.\nThe default value is set to false.\n\n Private key escrowing (boolean) :\n\nTells whether the private key should be escrowed by Horizon. (only for Centralized enrollment )\nThe default value is set to false.\n\n Key type (select) :\n\nSelect the type of key to generate when using centralized enrollment mode.\n\n Password policy for PKCS#12 password * (select) :\n\nSelect a password policy previously created.\n\n Store encryption type (select) :\n\nSelect from the list the encryption type.\nThe default value is set to DES_AVERAGE.\n\n Show PKCS#12 Password On Recover (boolean) :\n\nTells whether the PKCS#12 password should be displayed on recover. Enabled when Private key escrowing is set to on.\nThe default value is set to false.\n\n Show PKCS#12 On Recover (boolean) :\n\nTells whether the PKCS#12 should be displayed on recover. Enabled when Private key escrowing is set to on.\nThe default value is set to false.\n\n Authorization and validation\n\n Authorization mode (select) :\n\nSelect from the list.\n\n Authorized :\n\n Enabled whitelist (boolean) :\n\nTells whether whitelist is enabled or not. The default value is set to false.\n\n CA * (select) :\n\nSelect a Certificate Authority previously created.\n\n X509 :\n\n Enrollment CAs (select) :\n\nAvailable only if mode at x509. Select a Certificate Authority previously created.\n\n Enabled whitelist (boolean) :\n\nTells whether whitelist is enabled or not. The default value is set to false.\n\n CA * (select) :\n\nSelect a Certificate Authority previously created.\n\n Challenge :\n\n Password policy (select) :\n\nSelect a password policy previously created. It is used for the challenge generation.\n\n Enabled whitelist (boolean) :\n\nTells whether whitelist is enabled or not. The default value is set to false.\n\n CA * (select) :\n\nSelect a Certificate Authority previously created.\n\n Renewal management\n\n Renewal period: ( finite duration ) :\n\nMust be a valid finite duration.\n\n Renewal CAs (select) :\n\nSelect a Certificate Authority previously created.\n\n Revoke on renew (boolean) :\n\nThe previous certificate will be revoked on renew if true. The default value is set to false.\n\n Revocation reason (select) :\n\nSelect the reason from the list. Available only if \"revoke on renew\" value is set to true.\n\n Self Permissions\n\n Revoke (boolean) :\n\nTells whether self revoke permission is granted or not. The default value is set to false.\n\n Request Revoke (boolean) :\n\nTells whether self request revoke permission is granted or not. The default value is set to false.\n\n Update (boolean) :\n\nTells whether self update permission is granted or not. The default value is set to false.\n\n Request Update (boolean) :\n\nTells whether self request update permission is granted or not. The default value is set to false.\n\n Recover (boolean) :\n\nTells whether self recover permission is granted or not. The default value is set to false.\n\n Request recover (boolean) :\n\nTells whether self request recover permission is granted or not. The default value is set to false.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the EST Profile.\n\n You won’t be able to delete a EST Profile if this one is referenced somewhere else.\n\n ACME\n SCEP", - "keywords": [ - "est", - "admin-guide", - "admin-guide/protocols/est", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:protocols:scep", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "SCEP", - "section": "admin-guide", - "slug": "admin-guide/protocols/scep", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/protocols/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/scep.html", - "breadcrumbs": ["Horizon", "Admin guide", "Protocols", "SCEP"], - "summary": "SCEP ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section refers to the SCEP protocol, as described by RFC 8894 . SCEP Profile This section details how to configure the SCEP Profile Prerequisites PKI Connector SCEP Authority ", - "content": "SCEP\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section refers to the SCEP protocol, as described by RFC 8894 .\n\n SCEP Profile\n\n This section details how to configure the SCEP Profile\n\n Prerequisites\n\n PKI Connector\n\n SCEP Authority\n\n How to configure SCEP Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access SCEP Profile from the drawer or card: Protocol > SCEP .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon use the name to identify the profile.\n\n Enabled (boolean) :\n\nTells whether the profile is enabled or not. The default value is set to true.\n\n PKI Connector * (select) :\n\nSelect a PKI connector previously created.\n\n Max certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Enabled NDES emulation mode (boolean) :\n\nTells whether the NDES emulation mode is enabled or not. The defaults value is set to false.\n\n DN Whitelist * (boolean) :\n\nTells whether the DN whitelist is enabled or not. The default value is set to false.\n\n SCEP protocol parameters\n\n Mode * (select) :\n\nChoose from the two modes RA or CA.\nThe default value is set to RA.\n\n SCEP Authority * (select) :\n\nSelect a previously created SCEP Authority .\n\n CAPS * (select) :\n\nSelect a caps from the list.\nThe default value is set to SHA.\n\n Encryption algorithm * (select) :\n\nSelect an encryption algorithm from the list.\n\n Password policy (select) :\n\nSelect a previously created password policy. It is used for the challenge generation.\n\n Renewal management\n\n Renewal period ( finite duration ) :\n\nMust be in valid finite duration.\n\n Revocation on SCEP renew? * (boolean) :\n\nThe previous certificate will be revoked on renew if true. The default value is set to false.\n\n Revocation reason * (select) :\n\nSelect the reason from the list. Available only if \"revocation on SCEP renew\" value is set to true.\n\n Self Permissions\n\n Revoke (boolean) :\n\nTells whether self revoke permission is granted or not. The default value is set to false.\n\n Request Revoke (boolean) :\n\nTells whether self request revoke permission is granted or not. The default value is set to false.\n\n Update (boolean) :\n\nTells whether self update permission is granted or not. The default value is set to false.\n\n Request Update (boolean) :\n\nTells whether self request update permission is granted or not. The default value is set to false.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the SCEP Profile.\n\n You won’t be able to delete a SCEP Profile if this one is referenced somewhere else.\n\n EST\n WCCE", - "keywords": [ - "scep", - "admin-guide", - "admin-guide/protocols/scep", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:protocols:wcce", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "WCCE", - "section": "admin-guide", - "slug": "admin-guide/protocols/wcce", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/protocols/wcce.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/wcce.html", - "breadcrumbs": ["Horizon", "Admin guide", "Protocols", "WCCE"], - "summary": "WCCE ⚠ Deprecated: This version reached LDOS on 28/09/2024. Introduction This section details how to configure and consume the Windows Client Certificate Enrollment (WCCE) protocol. Managing certificate lifecycle through the WCCE protocol i", - "content": "WCCE\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Introduction\n\n This section details how to configure and consume the Windows Client Certificate Enrollment (WCCE) protocol.\n\n Managing certificate lifecycle through the WCCE protocol involves up to three components:\n\n Active Directory asset (domain controller, server, workstation, user) as WCCE Client;\n\n WinHorizon as the Active Directory enrollment service;\n\n Horizon as the WCCE proxy;\n\nWCCE enrollment modes will be detailed later on.\n\n The protocol paradigm can be described as follows: ' every Windows Active Directory member (machines, users) can use DCOM interfaces to interact with a CA to request certificate enrollment '.\n\n The following schema is a simplified workflow of an WCCE enrollment:\n\nThe protocol is based on the notion of Active Directory membership and configuration.\nActive Directory clients (such as machines and users) having rights on Microsoft Certificate Templates can use Active Directory enrollment service through DCOM interface to request certificate enrollment.\n\n Horizon supports different WCCE enrollment modes:\n\n Entity : Certificate’s elements are built using Active Directory content;\n\n Enrollment On Behalf of Others (EOBO) : Certificate signing request (CSR) is signed by one/many Certificate Enrollment Agent(s);\n\n Trust request : Certificate signature request (CSR) content is fully trust and certificate will be created using its content.\n\nFor Enrollment On Behalf of Others (EOBO) enrollment mode, it is possible to configure a whitelist of Authorized CAs trusted as issuers of enrollment agent certificates.\n\n Windows official resources\n\n EverTrust WCCE implementation is based on official WCCE documentation provided by Microsoft:\n\n MS-WCCE: Windows Client Certificate Enrollment Protocol\n\n Prerequisites\n\n WinHorizon should be installed using WinHorizon installation guide ;\n\n WinHorizon and Active Directory should be configured using WinHorizon administration guide .\n\n WCCE Forest\n\n The first step is to register WCCE Forest on which you want to use WCCE protocol through Horizon.\n\n Uses\n\n MSAD Connector\n\n How to configure WCCE Forest\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE Forest from the drawer or card: Protocol > WCCE > Forest .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Forest Name * (string input) :\nEnter the Active Directory forest name.\n\n 5. Click on the save button.\n\n You can duplicate or delete the WCCE Forest.\n\n You won’t be able to delete an WCCE Forest if it is referenced somewhere else.\n\n WCCE Profile\n\n The second step details how to create and configure a WCCE Horizon profile. This profile is an internal Horizon profile.\n\n Uses\n\n WCCE Template Mapping\n\n WCCE Scheduled Tasks\n\n Prerequisites\n\n PKI\n\n How to configure a WCCE Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE Profile from the drawer or card: Protocol > WCCE > Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of an URL, it is advisable to use only lower case letters and dashes.\n\n Enabled * (boolean) :\n\nIndicates whether the profile is enabled or not. The default value is set to true.\n\n Max certificate per holder (int) :\n\nIf specified, defines the maximum number of active certificates for a given Holder. If the number of active certificates exceeds this parameter, then the oldest certificate(s) above the limit will be automatically revoked.\n\n PKI (select) :\n\nSelect a PKI connector previously created.\n\n Self Permissions\n\n Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to revoke the certificate with no validation workflow. The default value is set to false.\n\n Request Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request the revocation of the certificate. The default value is set to false.\n\n Update (boolean) :\nSpecify whether the certificate’s owner is authorized to update the certificate with no validation workflow. The default value is set to false.\n\n Request Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request certificate’s update. The default value is set to false.\n\n Recover (boolean) :\n\nSpecify whether the certificate’s owner is authorized to recover the certificate with no validation workflow. The default value is set to false.\n\n Request recover (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request certificate’s recover. The default value is set to false.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the WCCE Profile .\n\n You won’t be able to delete a WCCE Profile if this one is referenced somewhere else.\n\n WCCE Template Mapping\n\n The third and last step is to configure mapping between Microsoft Certificate Template configured on Active Directory and Horizon WCCE profile. A mapping is created using a specific enrollment mode.\nAs a result of this mapping, every Microsoft Certificate Template can issue certificate from different PKI (using PKI connector of WCCE profile associated to Microsoft Certificate Template).\n\n Prerequisites\n\n WCCE Forest\n\n WCCE Profile\n\n How to configure WCCE Template Mapping\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE Forest from the drawer or card: Protocol > WCCE > Forest .\n\n 3. Identify the section corresponds to the forest for which you want to add mapping. Click on + button.\n\n 4. Fill the mandatory fields.\n\n Microsoft Template Name * (string input) :\n\nEnter the Microsoft Certificate Template name created on Active Directory side.\n\n Enrollment mode (select) :\n\nSpecify the enrollment mode of this mapping.\n\n EOBO CAs (select) :\n\nSpecify the CA(s) to use for EOBO enrolment.\n\n Profile * (select) :\n\nSelect a previously created WCCE profile.\n\n 5. Click on the save button.\n\n You can edit or delete the WCCE Template mapping.\n\n WCCE test enrollment\n\n This section details how to use the Microsoft Management Console (MMC) to manually retrieve a certificate through WCCE using different enrollment modes.\nIf you want to enroll machine certificate you need to perform the following actions using Administrator Account.\n\n 1. Launch mmc.exe\n\n 2. Click on File > Add/Remove or Remove Snap-ins\n\n 3. On the left panel, click on Certificates then Add\n\nIf you don’t have administrative privileges, the User certificate store will be automatically chosen.\nIf your account has administrative privileges, it will be prompted a window to choose Microsoft Certificate Store to use.\nIf you want to enroll User certificate please chose My user account .\nIf you want to enroll Machine certificate (computer or IIS for example) please chose Computer account .\n\n 4. Navigate to Personal > Certificates\n\n 5. Right click on Windows and chose All tasks > Request certificate\n\n 6. Click on Next\n\n 7. On the next step, let default enrollment policy configuration, then click on Next\n\n The next step lists all Microsoft Certificate Templates on which you have enrollment rights.\nThe Microsoft Certificate template selection and last parts of this testing procedure are specific to the enrollment mode you want to perform.\n\n Please refer to the proper section below.\n\n Requesting a certificate using 'Entity' enrollment mode\n\n 8. Select the Microsoft Certificate Template configured on Horizon side as a part of a Template Mapping using Entity enrollment mode. Click on Next\n\n 9. Click on Enroll to request Enrollment.\n\n 10. Enrollment is requested to WinHorizon. Few seconds later, if enrollment is successful it will be displayed STATUS: Succeeded . Click on Finish .\n\n 11. Your certificate is displayed and available.\n\n Requesting a certificate using 'Enrollment On Behalf of Others' enrollment mode\n\n 8. Identify the Microsoft Certificate Template configured on Horizon side as a part of a Template Mapping using Enrollment On Behalf of Others (EOBO) enrollment mode. Click on Details then Properties .\n\n 9. Navigate to Extensions tab and select Enrollment Agent Certificate (to be used to sign Certificate Request). Click on OK .\n\n 10. Click on Enroll to request Enrollment.\n\n 11. Enrollment is requested to WinHorizon. Few seconds later, if enrollment is successful it will be displayed STATUS: Succeeded . Click on Finish .\n\n 12. Your certificate is displayed and available.\n\n Requesting a certificate using 'Trust request' enrollment mode\n\n 8. Identify the Microsoft Certificate Template configured on Horizon side as a part of a Template Mapping using Trust request enrollment mode. Click on Details then Properties .\n\n 9. Navigate to Subject tab to build your Certificate request manually. Click on OK .\n\n 10. Click on Enroll to request Enrollment.\n\n 11. Enrollment is requested to WinHorizon. Few seconds later, if enrollment is successful it will be displayed STATUS: Succeeded . Click on Finish .\n\n 12. Your certificate is displayed and available.\n\n WCCE MSAD Connector\n\n This section details how to to configure the Microsoft Active Directory Connectors.\n\n Uses\n\n WCCE Scheduled Tasks\n\n Prerequisites\n\n WCCE Forest\n\n How to configure an MSAD Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access MSAD Connectors from the drawer or card: Protocol > WCCE > MSAD Connectors .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (select) :\n\nSelect the Active Directory Forrest you want to use to set up the connector.\n\n Hostname * (string input) :\n\nDNS name or IP of the Active Directory domain.\n\n Port (string input) :\n\nPort to connect to the Active Directory. The default value is set to 636.\n\n Proxy (select) :\n\nSelect a proxy to connect to the Active Directory, if needed.\n\n Bind DN * (string input) :\n\nDN of the Active Directory account. Must have right privileges to browse and list objects.\n\n Password * (string input) :\n\nPassword associated with aforementioned Active Directory DN account.\n\n Timeout * ( finite duration ) :\n\nThe time before Horizon stop trying to connect to Active Directory. Must be in valid finite duration.\n\n Max stored certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Assets identification\n\n Base DN * (string input) :\n\nIt can be the root of your domain or a restriction.\n\n LDAPPUB Filter (string input) :\n\nThis filter must respect LDAPPUB filter syntax.\n\n Actor management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be requested more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nThe default value is set to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nThe default value is set to 3.\n\n 5. Click on the save button.\n\n You can update or delete the MSAD Connector.\n\n You won’t be able to delete a MSAD Connector if this one is referenced somewhere else.\n\n WCCE Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically on your WCCE profiles. You will be able to use MSAD Connector to browse Active Directory and retrieve changes (basically computer removal) to trigger certificate revocation.\nThis mechanism works using comparison between Active Directory content (using MSAD connector) and Horizon certificate list based on a specific WCCE profile.\nIf Horizon has a certificate for a holder that does not exist on Active Directory side a revocation will be triggered automatically.\n\n Prerequisites\n\n WCCE Forest\n\n WCCE Profiles\n\n MSAD Connectors\n\n How to configure WCCE Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE scheduled tasks from the drawer or card: Protocol > WCCE > Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n WCCE Profile * (select) :\n\nSelect the target WCCE profile.\n\n Target Connector * (select) :\n\nSelect the MSAD connector to use as golden source of active Active Directory objects.\n\n Cron scheduling in Quartz format ( cron expression ) :\n\nEnter a Cron scheduling expression (in Quartz format). Default value is every 5 hours.\n\n Revoke (boolean) :\n\nIf true, will revoke all certificate that do not exist on the AD side.\n\n Dry run (boolean) :\n\nIf enabled, revocation actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run , update or delete the Schedules Tasks.\n\n SCEP\n WebRA", - "keywords": [ - "wcce", - "admin-guide", - "admin-guide/protocols/wcce", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:protocols:webra", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "WebRA", - "section": "admin-guide", - "slug": "admin-guide/protocols/webra", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/protocols/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/webra.html", - "breadcrumbs": ["Horizon", "Admin guide", "Protocols", "WebRA"], - "summary": "WebRA ⚠ Deprecated: This version reached LDOS on 28/09/2024. WebRA Profile This section details how to configure the WebRA Profile. Required By WebRA Scheduled Tasks Prerequisites WebRA Template PKI How to configure WebRA Profile 1. Log in ", - "content": "WebRA\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n WebRA Profile\n\n This section details how to configure the WebRA Profile.\n\n Required By\n\n WebRA Scheduled Tasks\n\n Prerequisites\n\n WebRA Template\n\n PKI\n\n How to configure WebRA Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WebRA Profiles from the drawer or card: Protocols > WebRA > Profiles .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name, this setting will be the profile identifier. It must be unique for each profile.\n\n Enabled (boolean) :\n\nShould the profile be enabled. The default value is set to true.\n\n WebRA Template * (select) :\n\nSelect a previously created WebRA Template.\n\n * PKI * (select) :\n\nSelect a previously created PKI connector.\n\n Max certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Cryptographic Policy\n\n Allowed key type * (select) :\n\nSelect from the list the allowed key types.\nThe default values are set to RSA / 2048 and RSA / 3072.\n\n Decentralized enrollment (boolean) :\n\nTells whether the profile should be used with a decentralized enrollment mode, i.e CSR (PKCS#10) signing by the PKI. The default value is set to false.\n\n Centralized enrollment (boolean) :\n\nTells whether the profile should be used with a centralized enrollment, i.e providing a PKCS#12. The default value is set to false.\n\n Private key escrowing (boolean) :\n\nTells whether the private key should be escrowed by Horizon. Only available if Centralized enrollment is set to true. The default value is set to false.\n\n PKCS#12 Password generation mode * (select) :\n\nDefine if the PKCS#12 password is chosen by the user on the request (manual) or generated randomly (random). Only available if Centralized enrollment is set to true.\n\n Password policy for PKCS#12 password * (select) :\n\nSelect a previously created password policy . Only available if Centralized enrollment is set to true.\n\n Store encryption type (select) :\n\nSelect from the list the encryption type. Only available if Centralized enrollment is set to true. The default value is set to DES_AVERAGE.\n\n Show PKCS#12 Password On Enroll (boolean) :\n\nTells whether the PKCS#12 password should be displayed on enroll. Only available if Centralized enrollment is set to true. The default value is set to false.\n\n Show PKCS#12 On Enroll (boolean) :\n\nTells whether the PKCS#12 should be displayed on enroll. Only available if Centralized enrollment is set to true. The default value is set to false.\n\n Show PKCS#12 Password On Recover (boolean) :\n\nTells whether the PKCS#12 password should be displayed on recover. Enabled when the private key escrowing value is set to on. The default value is set to false.\n\n Show PKCS#12 On Recover (boolean) :\n\nTells whether the PKCS#12 should be displayed on recover. Enabled when the private key escrowing value is set to on. The default value is set to false.\n\n Self Permissions\n\n Revoke (boolean) :\n\nTells whether self revoke permission is granted or not. The default value is set to false.\n\n Request Revoke (boolean) :\n\nTells whether self request revoke permission is granted or not. The default value is set to false.\n\n Update (boolean) :\n\nTells whether self update permission is granted or not. The default value is set to false.\n\n Request Update (boolean) :\n\nTells whether self request update permission is granted or not. The default value is set to false.\n\n Recover (boolean) :\n\nTells whether self recover permission is granted or not. The default value is set to false.\n\n Request recover (boolean) :\n\nTells whether self request recover permission is granted or not. The default value is set to false.\n\n Triggers\n\n WebRA profiles support the use of third-party triggers in the form of callbacks on specific events happening on the profile, giving a way to synchronize the third party repositories and Horizon.\n\n Enrollment (select) :\n\nSelect the third party trigger(s) to call whenever a certificate is enrolled on this profile.\n\n Revocation (select) :\n\nSelect the third party trigger(s) to call whenever a certificate gets revoked on this profile.\n\n Expire (select) :\n\nSelect the third party trigger(s) to call whenever a certificate expires on this profile.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the WebRA Profile.\n\n You won’t be able to delete a WebRA Profile if it is referenced somewhere else.\n\n WebRA Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically with your WebRA profiles.\n\n Prerequisites\n\n AWS Connector\n\n AKV Connector\n\n F5 Connector\n\n WebRA Profile\n\n How to configure WebRA Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access the \"Scheduled tasks\" from the drawer or card: Protocols > WebRA > Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n WebRA Profile * (select) :\n\nSelect a previously created WebRA profile.\n\n Target Connector * (select) :\n\nSelect a previously created third party connector.\n\n Cron scheduling ( cron expression ) :\n\nEnter a Cron scheduling expression (in Quartz format). The default expression is built to run the task every 5 hours.\n\n Revoke (boolean) :\n\nIf enabled, will revoke all certificate whose container was deleted from the third party repository.\nThe default value is set to false.\n\n Renew (boolean) :\n\nIf enabled, will renew all certificate who are about to expire. The default value is set to false.\n\n Dry run (boolean) :\n\nIf enabled, revocation and renewal actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run or edit or delete the Schedules Tasks.\n\n WebRA Template\n\n This section details how to define a custom structure for the fields subject DN & SAN of the requested certificate in order to match the configuration on the PKI side.\n\n How to configure WebRA Template\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WebRA Templates from the drawer or card: Protocols > WebRA > Templates .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Details\n\n Template Name * (string input) :\nEnter a meaningful WebRA template name. It must be unique for each template.\n\n Subject DN composition\n\n You can add more elements by clicking the add button.\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Regex (string input) :\n\nEnter a regular expression that the element should match.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n You can remove an element by clicking the delete button .\n\n SAN composition\n\n You can add more elements by clicking the add button.\n\n Element * (select) :\n\nSelect an attribute from the element list.\n\n Mandatory (boolean) :\n\nTells whether the element should be mandatory. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Regex (string input) :\n\nEnter a regular expression that the element should match.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver [.mysize]_(boolean)_s:\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n You can remove an element by clicking the delete button .\n\nWhen adding a SAN or a DN element and making it mandatory, make sure to either give it a default value or make it editable by the requester, otherwise the template will be unusable.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the WebRA template.\n\n You won’t be able to delete WebRA template if it is referenced somewhere else.\n\n WCCE\n Common configuration elements for profiles", - "keywords": [ - "webra", - "admin-guide", - "admin-guide/protocols/webra", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:reports", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Reports", - "section": "admin-guide", - "slug": "admin-guide/reports", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/reports.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/reports.html", - "breadcrumbs": ["Horizon", "Admin guide", "Reports"], - "summary": "Reports ⚠ Deprecated: This version reached LDOS on 28/09/2024. A report is a CSV file sent in a scheduled mail. The CSV content is managed by: HCQL query (certificates), HRQL query (requests) CSV fields shown Prerequisites You may need Team", - "content": "Reports\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n A report is a CSV file sent in a scheduled mail. The CSV content is managed by:\n\n HCQL query (certificates), HRQL query (requests)\n\n CSV fields shown\n\n Prerequisites\n\n You may need Teams .\n\n How to configure Reports\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Reports from the drawer or card: Reports .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Details\n\n Enabled (boolean) :\n\nTells whether the reporting task should be enabled. Set by default at true.\n\n Name * (string input) :\n\nEnter a meaningful report name. It must be unique.\n\n Cron scheduling expression in Quartz format * ( cron expression ) :\n\nEnter a Cron scheduling expression (in Quartz format). The default expression is built to run the task every hour.\n\n Recipients\n\n Click on to add a recipient.\n\n You can either target :\n\n A static (recipient): you will need to set a valid email address.\n\n A team contact: you will need to select one of the enabled teams.\n\n A team manager: you will need to select one of the enabled teams.\n\n Email\n\n From * (string input) :\n\nEnter the email address that will appear in the \"From\" field of the email.\n\n Subject * (string input) :\n\nEnter the subject of the email.\n\n Body (string input) :\n\nEnter the body of the email.\n\n CSV file name (string input) :\n\nEnter the name that will be given to the attached csv file.\n\n Is HTML (boolean) : (boolean):\n\nSets whether the email body contains HTML code (true) or plain text (false). The default value is set to false.\n\n HQL\n\n HQL Type * (select) :\n\nEither chose Certificate or Request. It will define the HQL Query type to set and the enabled CSV fields.\n\n Query (string input or select) :\n\nHCQL (Certificate) or HRQL (Request). You can select one of your saved queries.\n\n CSV\n\n You can select which fields will appear on the CSV file.\n\n 5. Click on the save button.\n\n You can run , edit or delete the report .\n\n Finite Duration\n Introduction", - "keywords": [ - "reports", - "admin-guide", - "admin-guide/reports", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:security:accounts", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Local Accounts", - "section": "admin-guide", - "slug": "admin-guide/security/accounts", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/security/accounts.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/accounts.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Local Accounts"], - "summary": "Local Accounts ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure the EverTrust Horizon local accounts and set their password. Local accounts are useful to create technical accounts, such as require", - "content": "Local Accounts\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure the EverTrust Horizon local accounts and set their password.\n\n Local accounts are useful to create technical accounts, such as required by horizon-cli for some scenarios (e.g. Scan/Discovery)\n\n How to create local accounts\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Local accounts from the drawer or card: Security > Access Management > Local Accounts .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Identifier * (string input) :\n\nEnter a meaningful identifier for the account holder. It will be used as a login to access to the solution.\n\n Name (string input) :\n\nEnter a meaningful name for the account holder.\n\n Email (string input) :\n\nEnter the account holder email.\n\n 5. Click on the save button.\n\n How to set a password to a local account\n\n 1. Once a local account is created. Click on .\n\n 2. Fill in the mandatory fields.\n\n Password * (string input) :\n\nSet a password.\n\n Confirm password * (string input) :\n\nConfirm the password.\n\n 3. Click on the save button.\n\n You can edit or delete a local account. You can manage a local account password.\n\n You can not delete yourself from local accounts.\n\n Sectigo CMS\n Authorization", - "keywords": [ - "local", - "accounts", - "admin-guide", - "admin-guide/security/accounts", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:security:authorization", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Authorization", - "section": "admin-guide", - "slug": "admin-guide/security/authorization", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/security/authorization.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/authorization.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Authorization"], - "summary": "Authorization ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure the permissions granted to an account, either directly or through a configured role. Prerequisites According to the context, you migh", - "content": "Authorization\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure the permissions granted to an account, either directly or through a configured role.\n\n Prerequisites\n\n According to the context, you might need to set up:\n\n Roles\n\n Local accounts\n\n How to add an authorization manually or from a certificate\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Authorizations from the drawer or card: Security > Access Management > Authorizations .\n\n 3. Click on .\n\n 4. Click on Add Authorization Manually\n\n 5. Fill the mandatory fields.\n\n Either:\n\n Fill in an Identifier * (string input or import) :\n\nEnter a meaningful identifier. It can be either a local account identifier or an OpenID Connect identifier (usually email address).\n\n Import a certificate by clicking on certificate button .\n\n Contact email (string input) :\n\nEnter the contact email for the account.\n\n 6 . Click on add button.\n\n How to add an authorization from a search\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Authorizations from the drawer or card: Security > Access Management > Authorizations .\n\n 3. Click on .\n\n 4. Click on Search and Add Authorization\n\n 5. Fill one of the fields.\n\n Identifier * (string input) :\n\nEnter the identifier of the account to look for.\n\n Email * (string input) :\n\nEnter the email of the account to look for.\n\n 6 . Click on search button.\n\n 7 . Choose the identifier you want to add.\n\n 8 . Click on add button.\n\n You can update or delete Authorization.\n\n How to grant a permission\n\n 1. Click on .\n\n Role\n\n 2. Select a role previously created (if needed).\n\n Team\n\n 3. Select a team previously created (if needed).\n\n Configuration\n\n You can build here a configuration permission. The permission follows the pattern: Section / Module / Right.\n\n 4. Click on add button.\n\n 5. Select a section, then a module, then a submodule if there is, and a right.\n\n 6. Click on add button (Don’t forget to save).\n\n 7. Click on the save button if you are done.\n\n Lifecycle\n\n You can build here a lifecycle permission. The permission follows the pattern: Module / Profile / Right. You can further restrict the permission by adding a filter from the \"Horizon Permission Query Language\".\n\n 4. Click on add button.\n\n 5. Select a module, then a profile, and a right.\n\n 6. Click on add button. (don’t forget to save).\n\n 7. Click on the save button if you are done.\n\n Horizon requests lifecycle:\n\n Discovery\n\n You can build here a discovery permission. The permission follows the pattern: Module / Discovery campaign name / Right.\n\n 4. Click on add button.\n\n 5. Select a module, then a campaign, and a right.\n\n 6. Click on add button. (don’t forget to save)\n\n 7. Click on the save button if you are done.\n\n Local Accounts\n Roles", - "keywords": [ - "authorization", - "admin-guide", - "admin-guide/security/authorization", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:security:policies", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Password Policies", - "section": "admin-guide", - "slug": "admin-guide/security/policies", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/security/policies.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/policies.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Security", - "Password Policies" - ], - "summary": "Password Policies ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure password policies that will be used by Horizon. How to configure a Password Policy 1. Log in to Horizon Administration Interface.", - "content": "Password Policies\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure password policies that will be used by Horizon.\n\n How to configure a Password Policy\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Password Policies from the drawer or card: Security > Password Policies .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Name *:\n\nEnter a meaningful password policy name;\n\n Password range length * (int) :\n\nPassword length (0 is unlimited);\n\n Minimum of lowercase (int) :\n\nMinimum of lowercase characters in the password;\n\n Minimum of uppercase (int) :\n\nMinimum of uppercase characters in the password;\n\n Minimum of digit (int) :\n\nMinimum of digit in the password;\n\n Minimum of special character (int) :\n\nMinimum of special characters in the password;\n\n Special characters accepted (string input) :\n\nWhitelist of special characters accepted in the password.\n\n 5. Click on the save button.\n\n You can update or delete the Password Policy.\n\n You won’t be able to delete a Password Policy if it is referenced in any other configuration element.\n\n Roles\n Identity Providers Configuration", - "keywords": [ - "password", - "policies", - "admin-guide", - "admin-guide/security/policies", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:security:providers", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Identity Providers Configuration", - "section": "admin-guide", - "slug": "admin-guide/security/providers", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/security/providers.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/providers.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Security", - "Identity Providers Configuration" - ], - "summary": "Identity Providers Configuration ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure Identity Providers. Identity Providers are going to be used by Horizon to verify the identity of an end-user based", - "content": "Identity Providers Configuration\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure Identity Providers.\nIdentity Providers are going to be used by Horizon to verify the identity of an end-user based on the authentication performed by an external authorization server.\n\n How to configure an Identity Provider\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Identity Providers from the drawer or card: Security > Access Management > Identity Providers .\n\n 3. Click on .\n\n General tab\n\n 4. Select an identity provider type. Currently only OpenID is supported\n\n OpenID connect\n\n 5. Fill in all mandatory fields:\n\n Name * (string input) :\n\nEnter a meaningful identity provider name.\n\n Provider metadata URL * (string input) :\n\nEnter the OpenID Connect provider metadata URL.\n\n Client ID * (string input) :\n\nIdentifier generated on the OpenID Connect IDP when setting up a new application (Horizon) to authenticate users on the identity provider.\n\n Client Secret * (string input) :\n\nPassword associated to the aforementioned identifier (Client ID);\n\n Scope * (string input) :\n\nScope used by Horizon during authentication on the identity provider to authorize access to user’s details.\n\n Proxy (string input) :\n\nProxy used to access Provider metadata URL, if any.\n\n Timeout ( finite duration ) :\n\nTimeout used for authentication on the identity provider. Must be a valid finite duration. By default 10 seconds.\n\n Identifier Claim * (string input) :\n\nDynamic expression defining how to construct the identifier from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user identifier is contained in the login claim, then the configured value should be {{login}} .\n\n Email Claim * (string input) :\n\nDynamic expression defining how to construct the user email from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user email is contained in the 'email' claim, then the configured value should be {{email}} . If the email is not available directly from the claims but can be computed from the 'login' claim by appending a domain, the configured value should be {{login}}@evertrust.fr .\n\n Name Claim * (string input) :\n\nDynamic expression defining how to construct the username from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user name must be constructed as family name, given name and family name is available in the family_name claim, given name is available in the given_name claim, then the configured value should be {{family_name}}, {{given_name}} .\n\n Enabled * (boolean) :\n\nEnable/Disable the identity provider.\n\n Enabled on UI * (boolean) :\n\nEnable/Disable the identity provider on user interface.\n\n Languages tab\n\n *\n* Language : Please refer to Languages section to set up localized Identity Provider display name and description.\n\n 6. Click on the save button.\n\n You can update or delete the Identity Provider.\n\n You won’t be able to delete an Identity Provider if it is referenced in any other configuration element.\n\n Password Policies\n Teams", - "keywords": [ - "identity", - "providers", - "configuration", - "admin-guide", - "admin-guide/security/providers", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:security:roles", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Roles", - "section": "admin-guide", - "slug": "admin-guide/security/roles", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/security/roles.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/roles.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Roles"], - "summary": "Roles ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure the roles. Roles are groups of permissions that can be configured for authorizations. How to create a role 1. Log in to Horizon Administratio", - "content": "Roles\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure the roles. Roles are groups of permissions that can be configured for authorizations.\n\n How to create a role\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Roles from the drawer or card: Security > Access Management > Roles .\n\n 3. Click on .\n\n 4. Fill in at least the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful name.\n\n Description (string input) :\n\nEnter a description.\n\n 6. configuration permissions\n\n 7. lifecycle permissions\n\n 8. discovery permissions\n\n 9. Click on the save button.\n\n You can get the list of members .\n\n You can update or delete the Role.\n\n Authorization\n Password Policies", - "keywords": [ - "roles", - "admin-guide", - "admin-guide/security/roles", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:security:teams", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Teams", - "section": "admin-guide", - "slug": "admin-guide/security/teams", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/security/teams.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/teams.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Teams"], - "summary": "Teams ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure teams. Teams are groups of horizon objects owner (certificates, requests) and does not define permissions. How to create a team 1. Log in to ", - "content": "Teams\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure teams. Teams are groups of horizon objects owner (certificates, requests) and does not define permissions.\n\n How to create a team\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Teams from the drawer or card: Security > Access Management > Teams .\n\n 3. Click on .\n\n 4. Fill at least the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful name.\n\n Description (string input) :\n\nEnter a description.\n\n Contact email (string input) :\n\nEnter a valid mail.\n\n Manager email (string input) :\n\nEnter a valid mail.\n\n Messaging tool (select) :\n\nSelect one of Webhook Messaging tools supported\n\n URL (string input) :\n\nEnter the webhook messaging URL for the team(used by Messaging notification )\n\n 5. Click on the save button.\n\n You can get the list of members .\n\n You can update or delete the Team.\n\n Identity Providers Configuration\n Notifications", - "keywords": [ - "teams", - "admin-guide", - "admin-guide/security/teams", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:system:http_proxies", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "HTTP Proxy", - "section": "admin-guide", - "slug": "admin-guide/system/http_proxies", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/system/http_proxies.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/system/http_proxies.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "System configuration", - "HTTP Proxy" - ], - "summary": "HTTP Proxy ⚠ Deprecated: This version reached LDOS on 28/09/2024. In this section you will be able to set up HTTP Proxies. HTTP Proxies may be used by Horizon to establish connection to various services. How to configure an HTTP Proxy 1. Lo", - "content": "HTTP Proxy\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n In this section you will be able to set up HTTP Proxies. HTTP Proxies may be used by Horizon to establish connection to various services.\n\n How to configure an HTTP Proxy\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access HTTP Proxy from the drawer or card: System > HTTP Proxies .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful HTTP Proxy name.\n\n Host * (string input) :\n\nThe Hostname or IP Address of the HTTP/HTTPS proxy to use.\n\n Port * (int) :\n\nThe Port of the HTTP/HTTPS proxy to use.\n\n 5. Click on the create button to save.\n\n You can update or delete the HTTP Proxy.\n\n You won’t be able to delete an HTTP Proxy if it is referenced in any other configuration element.\n\n Labels\n Cron Expression", - "keywords": [ - "http", - "proxy", - "admin-guide", - "admin-guide/system/http_proxies", - "horizon", - "admin", - "guide", - "system", - "configuration" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:system:labels", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Labels", - "section": "admin-guide", - "slug": "admin-guide/system/labels", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/system/labels.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/system/labels.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "System configuration", - "Labels" - ], - "summary": "Labels ⚠ Deprecated: This version reached LDOS on 28/09/2024. You will be able to associate the labels created in this section with your profiles in order to enrich the certificates that will be issued from them. How to configure a Label 1.", - "content": "Labels\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n You will be able to associate the labels created in this section with your profiles in order to enrich the certificates that will be issued from them.\n\n How to configure a Label\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Labels from the drawer or card: System > Labels .\n\n 3. Click on .\n\n 4. Fill the following fields:\n\n Name * (string input) :\n\nEnter a meaningful Label name.\n\n Language * (select) :\n\nPlease refer to Languages section to set up localized Label display name and description.\n\n Display name (string input) :\n\nThe name that will be displayed for this label in the selected language. Optional.\n\n Description (string input) :\n\nThe description of this label in the selected language. Optional.\n\n 5. Click on the create button to save.\n\n You can update or delete Labels.\n\n You won’t be able to delete a Label if it is referenced in any other configuration element.\n\n SCEP Authorities\n HTTP Proxy", - "keywords": [ - "labels", - "admin-guide", - "admin-guide/system/labels", - "horizon", - "admin", - "guide", - "system", - "configuration" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:system:scep_authorities", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "SCEP Authorities", - "section": "admin-guide", - "slug": "admin-guide/system/scep_authorities", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/system/scep_authorities.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.5/admin-guide/system/scep_authorities.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "System configuration", - "SCEP Authorities" - ], - "summary": "SCEP Authorities ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure SCEP Authorities. The draft-nourse-scep-23 as well as RFC 8894 define how SCEP communications are secured. This involves using a S", - "content": "SCEP Authorities\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure SCEP Authorities.\n\n The draft-nourse-scep-23 as well as RFC 8894 define how SCEP communications are secured. This involves using a SCEP Authority, which is a certificate and its associated private key, used to sign and encrypt communications between SCEP server and client.\n\n Two setups are possible:\n\n the CA mode in which the SCEP Authority is a self-signed certificate. In that mode the SCEP server returns the self-signed certificate as application/x-x509-ca-cert when the client uses the GetCaCert call.\n\n the RA mode in which the SCEP Authority is a certificate signed by the CA that will issue certificates using the considered SCEP profile. In that mode, the SCEP server returns the SCEP Authority certificate and its issuing CA chain as application/x-x509-ca-ra-cert when the client uses the GetCaCert call.\n\n Therefore, it is important in each SCEP or MDM Profile to align the SCEP mode with the characteristics of the SCEP Authority configured in the current section.\n\n Prerequisites\n\n PKCS#12 containing the SCEP Authority certificate and private key. See above for explanation about the SCEP contents.\n\n How to configure a SCEP Authority\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access SCEP Authorities from the drawer or card: System > SCEP Authorities .\n\n 3. Click on .\n\n 4. Fill the following fields:\n\n Name * (string input) :\n\nEnter a meaningful SCEP Authority name;\n\n PKCS#12 * (import p12) :\n\nPKCS#12 of the SCEP Authority;\n\n PKCS#12 Password * (string input) :\n\nPassword of the aforementioned PKCS#12.\n\n 5. Click on the create button to save.\n\n You can update or delete the SCEP Authority.\n\n You won’t be able to delete a SCEP Authority if it is referenced in any other configuration element.\n\n jamf Pro\n Labels", - "keywords": [ - "scep", - "authorities", - "admin-guide", - "admin-guide/system/scep_authorities", - "horizon", - "admin", - "guide", - "system", - "configuration" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:third-parties:akv", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Azure Key Vault Integration", - "section": "admin-guide", - "slug": "admin-guide/third-parties/akv", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/third-parties/akv.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/akv.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "Azure Key Vault Integration" - ], - "summary": "Azure Key Vault Integration ⚠ Deprecated: This version reached LDOS on 28/09/2024. Introduction This section refers to the Azure Key Vault (AKV) integration with Horizon, used to enroll certificates held in AKV. This integration involves at", - "content": "Azure Key Vault Integration\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Introduction\n\n This section refers to the Azure Key Vault (AKV) integration with Horizon, used to enroll certificates held in AKV.\n\n This integration involves at least three infrastructure components:\n\n Azure Key Vault\n\n Azure Active Directory\n\n EverTrust Horizon\n\n Azure AD is used to authenticate Horizon, which should be a registered application.\n\n Azure AKV Connector\n\n Here is the section to manage the Azure AKV Connector.\n\n Required By\n\n AKV Trigger\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy used to reach Azure, if necessary.\n\n On Azure AD side, it is required to set up an application by following Microsoft’s guide .\n\n Horizon supports only client secret authentication\n\n After performing these steps, you will get the following information, required later:\n\n the Tenant ID\n\n the Application ID\n\n the Application Authentication Key\n\n Finally, you should give all Certificate Permissions to the Application you created for Horizon inside the target Azure Key Vault \"Access policies\" menu entry, using the \"Add Access Policy\" link.\n\n How to configure AKV Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AKV Connectors from the drawer or card: Third Parties > AKV > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful Connector Name.\n\n Azure Tenant * (string input) :\n\nEnter the Tenant, which is the domain name after the @ sign in your account.\n\n App ID * (string input) :\n\nEnter the app ID.\n\n App Key * (string input) :\n\nEnter the app Key.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy used to reach Azure AD and AKV, if necessary.\n\n Timeout ( finite duration ) :\n\nSet on the connections used to reach Azure AD and AKV. Configured by default at 10 seconds. Must be in valid finite duration.\n\n Vault fully qualified domain name * (string input) :\n\nFully qualified domain name used to reach the Azure Key Vault to be managed by Horizon.\n\n Assets identification and management\n\n Prefix (string input) : Used to filter the certificates managed by Horizon in the specified Azure Key Vault. Defaults to \"HRZ-\"\n\n Actors and renewal management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be in valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default at 3.\n\n Renewal period ( finite duration ) :\n\nMust be a valid finite duration.\n\n 5. Click on the save button.\n\n You can update or delete the AKV Connector.\n\n You will not be able to delete an AKV Connector if it is referenced in any other configuration element.\n\n AKV Trigger\n\n This section details how to configure the Triggers that will be used by WebRA Profiles to push or delete certificates to/from AKV.\n\n Prerequisites\n\n AKV Connector\n\n How to configure AKV Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AKV Triggers from the drawer or card: Third Parties > AKV > Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n Azure Key Vault Connector * (select) :\n\nSelect an AKV connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the AKV repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the AKV Trigger.\n\n AWS Certificate Manager Integration\n F5 BigIP Integration", - "keywords": [ - "azure", - "key", - "vault", - "integration", - "admin-guide", - "admin-guide/third-parties/akv", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:third-parties:aws", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "AWS Certificate Manager Integration", - "section": "admin-guide", - "slug": "admin-guide/third-parties/aws", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/third-parties/aws.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/aws.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "AWS Certificate Manager Integration" - ], - "summary": "AWS Certificate Manager Integration ⚠ Deprecated: This version reached LDOS on 28/09/2024. Introduction This section refers to the AWS Certificate Manager (ACM) integration with Horizon, used to enroll certificates held in ACM. This integra", - "content": "AWS Certificate Manager Integration\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Introduction\n\n This section refers to the AWS Certificate Manager (ACM) integration with Horizon, used to enroll certificates held in ACM.\n\n This integration involves at least two infrastructure components:\n\n AWS Certificate Manager\n\n EverTrust Horizon\n\n AWS Connector\n\n Here is the section to manage the AWS Connector.\n\n Required By\n\n AWS Trigger\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy , used to reach AWS, if necessary.\n\n On AWS side, you need to create a user using the AWS IAM module, and following AWS guide . You should create an access key for that user, and give him appropriate permissions. The created user should hold the following permissions:\n\n AWSResourceGroupsReadOnlyAccess\n\n ResourceGroupsandTagEditorReadOnlyAccess\n\n AWSCertificateManagerFullAccess\n\n After performing these steps, you will get the following information, required later:\n\n the AWS Region\n\n the User Access Key ID\n\n the User Access Key Secret\n\n On top of that, you need to define a Resource Group, using AWS Resource Groups and Tags Editor, with the following characteristics:\n\n Group Type: Tag based\n\n Resource Type: AWS::CertificateManager::Certificate\n\n Tag key and value (e.g. key=manage and value=HRZ)\n\n After performing this steps, you will get the following information, required later:\n\n The Resource Group name\n\n the Tag name\n\n the Tag value\n\n How to configure AWS Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AWS Connectors from the drawer or card: Third Parties > AWS > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Region * (string input) :\n\nEnter a valid AWS region. Here’s the region list from AWS.\n\n Access key ID (string input) :\n\nUser Access Key ID used by Horizon to connect to AWS.\n\n Access Key Secret (string input) :\n\nAccess Key Secret associated to the aforementioned User Access Key ID.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy to use to reach AWS, if any.\n\n Timeout * ( finite duration ) :\n\nThe timeout for Horizon-initiated connections to AWS. Must be a valid finite duration.\n\n Assets identification\n\n Resource group name (string input) :\n\nName of the resource group pointing to the tag name and value.\n\n Tag key (string input) :\n\nName of the tag used to identify certificates managed by Horizon in ACM.\n\n Tag value (string input) :\n\nValue of the tag used to identify certificates managed by Horizon in ACM.\n\n Actors and renewal management\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be in valid finite duration.\n\n Renewal period ( finite duration ) :\n\nCertificate renewal period (time before expiration to trigger renewal). Must be in valid finite duration.\n\n 5. Click on the save button.\n\n You can update or delete the AWS Connector.\n\n You won’t be able to delete an AWS Connector if it is referenced somewhere else.\n\n AWS Trigger\n\n Here is the section to manage the Triggers that will be used by WebRA Profiles to push or delete certificates to/from AWS ACM.\n\n Prerequisites\n\n AWS Connector\n\n How to configure AWS Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AWS Triggers from the drawer or card: Third Parties > AWS > Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n AWS Connector * (select) :\n\nSelect an AWS connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the AWS repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the AWS Trigger.\n\n You won’t be able to delete an AWS Trigger if it is referenced somewhere else.\n\n Common configuration elements for profiles\n Azure Key Vault Integration", - "keywords": [ - "aws", - "certificate", - "manager", - "integration", - "admin-guide", - "admin-guide/third-parties/aws", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:third-parties:f5", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "F5 BigIP Integration", - "section": "admin-guide", - "slug": "admin-guide/third-parties/f5", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/third-parties/f5.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/f5.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "F5 BigIP Integration" - ], - "summary": "F5 BigIP Integration ⚠ Deprecated: This version reached LDOS on 28/09/2024. Introduction This section refers to the F5 BigIP integration with Horizon, used to enroll certificates used by F5 BigIP. This integration involves at least two infr", - "content": "F5 BigIP Integration\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Introduction\n\n This section refers to the F5 BigIP integration with Horizon, used to enroll certificates used by F5 BigIP.\n\n This integration involves at least two infrastructure components:\n\n F5 BigIP\n\n EverTrust Horizon\n\n Horizon connects to the F5 BigIP using the iControl REST administration API in order to manage the lifecycle of certificates associated to Client SSL Profiles within the BigIP.\n\n F5 Connector\n\n This section details how to configure the F5 Connector.\n\n Prerequisites\n\n On the F5 BigIP side, you need to create a technical user for Horizon, and give it full administrator rights. This is required because only full admins have the right to upload certificates on an F5 BigIP.\n\n After performing these steps, you will get the following information, required later:\n\n the technical user login/username\n\n the technical user password\n\n How to configure F5 Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access F5 Connectors from the drawer or card: Third Parties > F5 > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n F5 BigIP hostname * (string input) :\n\nEnter the F5 BigIP hostname (DNS or IP address).\n\n F5 BigIP username * (string input) :\n\nUsername created for Horizon in the F5 BigIP. Must have administrator rights.\n\n F5 BigIP password * (string input) :\n\nPassword associated with aforementioned username.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy to use.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be a valid finite duration*.\n\n Max stored certificates per holder (int) :\n\nWhen specified, define the maximum number of certificates stored in the third party for a given holder.\n\n Assets identification\n\n Partition (string input) :\n\nF5 BigIP partition to manage. Common by default.\n\n SSL parent (string input) :\n\nName of the parent Client SSL Profile. Common by default.\n\n Prefix (string input) :\n\nUsed to filter the certificates managed by Horizon in the specified F5 Client. hrz- by default.\n\n Cipher group (string input) :\n\nName of the Cipher group. None by default.\n\n Actors and renewal management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be in valid finite duration*.\n\n Throttle parallelism * (int) :\n\nSet by default at 3.\n\n Renewal period * ( finite duration ) :\n\nMust be a valid finite duration*.\n\n 5. Click on the save button.\n\n You can update or delete the F5 Connector.\n\n You will not be able to delete an F5 Connector if it is referenced in any other configuration element.\n\n F5 Trigger\n\n This section details how to configure the Triggers that will be used by WebRA Profiles to push or delete certificates to/from F5 BigIP.\n\n Prerequisites\n\n F5 Connector\n\n How to configure F5 Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access F5 Triggers from the drawer or card: Third Parties > F5 > Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon use the name to identify the trigger.\n\n F5 Connector * (select) :\n\nSelect a connector F5 previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the F5 BigIP repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the F5 Trigger.\n\n Azure Key Vault Integration\n Intune", - "keywords": [ - "f5", - "bigip", - "integration", - "admin-guide", - "admin-guide/third-parties/f5", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:third-parties:intune", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Intune", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/third-parties/intune.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/intune.html", - "breadcrumbs": ["Horizon", "Admin guide", "Third parties", "Intune"], - "summary": "Intune ⚠ Deprecated: This version reached LDOS on 28/09/2024. Introduction This section details the Microsoft Endpoint Manager - Intune SCEP integration with Horizon, used to enroll, renew and revoke certificates on Intune managed devices. ", - "content": "Intune\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Introduction\n\n This section details the Microsoft Endpoint Manager - Intune SCEP integration with Horizon, used to enroll, renew and revoke certificates on Intune managed devices.\n\n This integration involves at least three infrastructure components:\n\n Microsoft Endpoint Manager / Intune\n\n Azure Active Directory\n\n EverTrust Horizon\n\n The enrolled devices interface with these components in order to retrieve their certificate.\n\n The diagram displays these components as well as the various flows involved in an enrollment.\n\n Microsoft describes the integration principles on their website: https://docs.microsoft.com/en-us/mem/intune/protect/certificate-authority-add-scep-overview\n\n Finally, this integration will require to set up, on Horizon side, the following elements:\n\n an Intune Connector, which holds the configuration items required for Horizon to connect to Azure AD and Intune\n\n an Intune Profile, which holds the configuration items specifying how Horizon should issue certificates for the specified Intune Connector\n\n an Intune Scheduled Task, which holds configuration items defining the scheduled task in charge of performing revocation upon decommissioning devices from Azure AD. This is optional.\n\n Intune Connector\n\n This section details how to configure an Intune Connector.\n\n Required By\n\n Intune Profile\n\n Intune Scheduled Task\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy , used to reach Azure/Intune, if necessary.\n\n On Azure AD side, it is required to set up an application by following Microsoft’s guide . Please note that you must add the Microsoft Graph / Directory.Read.All permission as well for the revocation feature to work properly. After performing these steps, you will get the following information, required later:\n\n the Tenant ID\n\n the Application ID\n\n the Application Authentication Key\n\n How to configure Intune Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune Connector from the drawer or card: Third Parties > Intune > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Azure Tenant * (string input) :\n\nEnter the Tenant ID.\n\n App ID * (string input) :\n\nEnter the Application ID.\n\n App Key * (string input) :\n\nEnter the Application Authentication Key.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy used to reach Azure AD and Intune.\n\n Timeout ( finite duration ) :\n\nTimeout set on the connection used to reach Azure AD and Intune. Configured by default at 10 seconds. Must be a valid finite duration.\n\n Assets identification and management\n\n OS query string (string input) :\n\nThis allows to restrict devices by OS when performing the devices listing used for the revocation feature. Leave blank to use the default setting if unsure.\n\n Intune resource URL (string input) :\n\nThis allows to point at a specific Intune installation. Used only in Hybrid Intune setups, leave blank otherwise.\n\n Legacy revocation mode (boolean) :\n\nActivate the legacy revocation mode. Default value is set to false.\n\n Actors management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default to 3.\n\n 5. Click on the save button.\n\n You can update or delete the Intune Connector.\n\n You will not be able to delete an Intune Connector if it is referenced in any other configuration element.\n\n Intune Profile\n\n This section details how to configure an Intune Profile.\n\n Required By\n\n Intune Scheduled Tasks\n\n Prerequisites\n\n Intune Connector\n\n PKI Connector\n\n SCEP Authority\n\n Setting up an SCEP Authority requires you to issue a certificate from the underlying PKI with the following characteristics:\n\n the issuing CA should be the same as the one that will issue certificates through the PKI Connector that will be linked to the Intune Profile\n\n the certificate key usages must include Digital Signature and Key Encipherment\n\n the certificate must be issued as PKCS#12 and then imported into Horizon\n\n How to configure Intune Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune Profile from the drawer or card: Third Parties > Intune > Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of an URL, it is advised to use only lower case letters and dashes.\n\n Enabled * (boolean) :\n\nIndicates whether the profile is enabled or not. Set to true by default.\n\n Intune Connector * (select) :\n\nSelect an Intune Connector previously created.\n\n PKI Connector (select) :\n\nSelect a PKI connector previously created.\n\n Max certificate per holder (int) :\n\nIf specified, defines the maximum number of active certificates for a given Holder. If the number of active certificates exceeds this parameter, then the oldest certificate(s) above the limit will be automatically revoked.\n\n Assets identification\n\n Device ID field name (string input) :\n\nSubject DN field used to retrieve the Device ID. The selected field must be set to {{AAD_Device_ID}} on Intune side, e.g. if you select \"L\", the configured Subject DN in the SCEP profile in Intune must then contain L={{AAD_Device_ID}} . This is required to use the automated revocation feature upon device decommission.\n\n Device ID separator (string input) :\n\nSeparator used to retrieve the Device ID in the device id field (if defined). This field is present for backward compatibility reasons and should normally be left to blank.\n\n SCEP protocol parameters\n\n Mode * (select) :\n\nChoose from one of the two modes RA or CA. Usually this should be set to RA .\n\n SCEP Authority (select) :\n\nSelect a SCEP Authority previously created. See Prerequisites for details.\n\n CAPS (select) :\n\nSelect one or many SCEP Capabilities from the list. If unsure, leave the default.\n\n Encryption algorithm (select) :\n\nSelect a SCEP Encryption Algorithm algorithms from the list. If unsure, leave the default.\n\n Renewal management\n\n Renewal period ( finite duration ) :\n\nMust be a valid finite duration.\n\n Revocation on SCEP renew *: (boolean)\n\nShould the expiring certificate be revoked upon SCEP renewal. Set by default to false.\n\n Revocation reason * (select) :\n\nSelect the reason from the list. Available only if revocation on SCEP renew is set to true.\n\n Self Permissions\n\n Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to revoke the certificate with no validation workflow. Set to false by default.\n\n Request Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request the revocation of the certificate. Set to false by default.\n\n Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to update the certificate with no validation workflow. Set to false by default.\n\n Request Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request certificate’s update. Set to false by default.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can update or delete the Intune Profile once it has been created.\n\n You won’t be able to delete an Intune Profile if it is referenced somewhere else.\n\n Last steps\n\n Once the profile created in Horizon, you need to setup a SCEP profile in Intune by following Microsoft documentation . You will need to match the parameters in the Intune SCEP profile with what has been set up in Horizon and in the underlying PKI. You need to pay special attention to:\n\n the certificate lifetime and renewal interval, which must match throughout the solution\n\n the Subject and Subject Alternative Name settings must match throughout the solution. In the end, the issued certificate must contain exactly what was configured in Intune for these fields, or the renewal will not work.\n\n the SCEP server URL, where you need to input the URL given in the Intune Profile that you created in Horizon\n\n To enroll Windows machines or users using Intune, you need to remove the trailing \" pkiclient.exe \" from the SCEP server URL\n\n Intune Scheduled Tasks\n\n This section details how to configure scheduled tasks which will run periodically on your Intune profiles, in order to manage automatic revocation upon device decommission.\n\n Prerequisites\n\n Intune Connector\n\n Intune Profile\n\n How to configure Intune Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune Scheduled Tasks from the drawer or card: Third Parties > Intune > Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Intune Profile * (select) :\n\nSelect an Intune profile previously created.\n\n Target Connector * (select) :\n\nSelect an Intune connector previously created.\n\n Cron scheduling ( cron expression ) :\n\nSet to every 5 hours by default.\n\n Revoke (boolean) :\n\nSet to false by default. If true, Horizon will revoke any certificate associated to a device that has been deleted from Azure AD (and hence decommissioned).\n\n Dry run (boolean) :\n\nIf enabled, revocation actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run , update or delete the Scheduled Tasks.\n\n F5 BigIP Integration\n Intune PKCS Connector", - "keywords": [ - "intune", - "admin-guide", - "admin-guide/third-parties/intune", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:third-parties:intunepkcs", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Intune PKCS Connector", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intunepkcs", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/third-parties/intunepkcs.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/intunepkcs.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "Intune PKCS Connector" - ], - "summary": "Intune PKCS Connector ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to configure the Intune PKCS Connector. This integration involves at least three infrastructure components: Microsoft Endpoint Manager / I", - "content": "Intune PKCS Connector\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to configure the Intune PKCS Connector.\n\n This integration involves at least three infrastructure components:\n\n Microsoft Endpoint Manager / Intune\n\n Azure Active Directory\n\n EverTrust Horizon\n\n The enrolled devices interface with these components in order to retrieve their certificate.\n\n The diagram displays these components as well as the various flows involved in an enrollment.\n\n Required By\n\n Intune PKCS Profile\n\n How to configure Intune PKCS Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Connectors from the drawer or card: Third Parties > Intune PKCS > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Azure Tenant * (string input) :\n\nValue must be set to Azure Tenant.\n\n App ID * (string input) :\n\nValue must be set to Azure App ID.\n\n App Key * (string input) :\n\nValue must be set to Azure App Key.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy to use.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be in valid finite duration.\n\n Search Filter (string input) :\n\nEnter search filter.\n\n Max stored certificates per holder (int) :\n\nWhen specified, define the maximum number of certificates stored in the third party for a given holder.\n\n Assets identification and management\n\n Key Name (string input) :\n\nEnter key name.\n\n Key Type (select) :\n\nSelect one key type from the list.\n\n Provider Name (string input) :\n\nEnter provider name.\n\n Public Key (string input) :\n\nEnter public key in PEM format.\n\n Intended Purpose (select) :\n\nSelect one intended certificate usage from the list.\n\n Actors and renewal management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default at 3.\n\n Renewal period ( finite duration ) :\n\nMust be a valid finite duration.\n\n 5. Click on the save button.\n\n You can update or delete the Intune PKCS Connector.\n\n You won’t be able to delete an Intune PKCS Connector if it is referenced in any other configuration element.\n\n Intune PKCS Profile\n\n This section details how to configure the Intune PKCS Profile\n\n Required By\n\n Intune PKCS Scheduled Tasks\n\n Prerequisites\n\n PKI Connector\n\n How to configure Intune PKCS Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Profiles from the drawer or card: Third Parties > Intune PKCS > Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each profile. Horizon uses the name to identify the profile.\n\n Enabled * (boolean) :\n\nIs the profile enabled or not. Set at true by default.\n\n Max certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n PKI Connector (select) :\n\nSelect a PKI connector previously created.\n\n Intune PKCS Connector * (select) :\n\nSelect an Intune PKCS Connector previously created.\n\n Crypto Policy\n\n Private key escrowing (boolean) :\n\nIs the private key escrowing. Set at false by default.\n\n PKCS#12 Password generation mode * (select) :\n\nDefine if the PKCS#12 password is chosen by the user on the request (manual) or generate randomly (random).\n\n Password policy for PKCS#12 password * (select) :\n\nSelect a password policy previously created.\n\n Store encryption type (select) :\n\nSelect from the list the encryption type. If unsure, leave on default \"DES_AVERAGE\".\n\n Show PKCS#12 Password On Recover (boolean) :\n\nShould the PKCS#12 password be displayed on recover. Activated with the private key escrowing.\nSet to false by default.\n\n Show PKCS#12 On Recover (boolean) :\n\nShould the PKCS#12 be displayed on recover. Activated with the private key escrowing.\nSet to false by default.\n\n Self Permissions\n\n Revoke (boolean) :\n\nHave the right to self revoke. Set by default at false.\n\n Request Revoke (boolean) :\n\nHave the right to self request revoke. Set by default at false.\n\n Update (boolean) :\n\nHave the right to self update. Set by default at false.\n\n Request Update (boolean) :\n\nHave the right to self request update. Set by default at false.\n\n Recover (boolean) :\n\nHave the right to self Recover the certificate. Set by default at false.\n\n Request recover (boolean) :\n\nHave the right to self request recover. Set by default at false.\n\n Triggers\n\n Intune PKCS profiles support the use of third-party triggers in the form of callbacks on specific events happening on the profile, giving a way to synchronize the third party repositories and Horizon.\n\n Enrollment (select) :\n\nSelect the third party trigger(s) to call whenever a certificate is enrolled on this profile.\n\n Revocation (select) :\n\nSelect the third party trigger(s) to call whenever a certificate gets revoked on this profile.\n\n Expire (select) :\n\nSelect the third party trigger(s) to call whenever a certificate expires on this profile.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can update or delete the Intune PKCS Profile.\n\n You won’t be able to delete an Intune PKCS Profile if it is referenced in any other configuration element.\n\n Intune PKCS Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically on your Intune PKCS profiles.\n\n Prerequisites\n\n Connector Intune PKCS\n\n Profile Intune PKCS\n\n How to configure Intune PKCS Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Scheduled Tasks from the drawer or card: Third Parties > Intune PKCS > Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Enabled (boolean) :\n\nTells whether the Scheduled task should be enabled. Set by default at true.\n\n Intune PKCS Profile * (select) :\n\nSelect an Intune PKCS profile previously created.\n\n Target Connector * (select) :\n\nSelect an Intune PKCS connector previously created.\n\n Cron scheduling ( cron expression ) :\n\nBy default set at every 5 hours.\n\n Enroll? (boolean) :\n\nIf enabled, will enroll all certificate from the third party repository.\nSet to false by default.\n\n Revoke? (boolean) :\n\nIf enabled, will revoke all certificate whose container was deleted from the third party repository.\nSet to false by default.\n\n Renew? (boolean) :\n\nIf enabled, will renew all certificate who are about to expire.\nSet to false by default.\n\n Dry run (boolean) :\n\nIf enabled, enroll, revocation and renewal actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run or update or delete the Schedules Tasks.\n\n Intune PKCS Trigger\n\n this section details how to configure the Triggers that will run automatically on your Intune PKCS connectors.\n\n Prerequisites\n\n Intune PKCS Connector\n\n How to configure Intune PKCS Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Triggers from the drawer or card: Third Parties > Intune PKCS > Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n Intune PKCS Connector * (select) :\n\nSelect an Intune PKCS connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the Intune PKCS repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the Intune PKCS Trigger.\n\n You won’t be able to delete an Intune PKCS Trigger if it is referenced in any other configuration element.\n\n Intune\n jamf Pro", - "keywords": [ - "intune", - "pkcs", - "connector", - "admin-guide", - "admin-guide/third-parties/intunepkcs", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:third-parties:jamf", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "jamf Pro", - "section": "admin-guide", - "slug": "admin-guide/third-parties/jamf", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/third-parties/jamf.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/jamf.html", - "breadcrumbs": ["Horizon", "Admin guide", "Third parties", "jamf Pro"], - "summary": "jamf Pro ⚠ Deprecated: This version reached LDOS on 28/09/2024. Introduction This section details the jamf Pro integration with Horizon, used to enroll, renew and revoke certificates on jamf Pro managed devices. This integration involves th", - "content": "jamf Pro\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Introduction\n\n This section details the jamf Pro integration with Horizon, used to enroll, renew and revoke certificates on jamf Pro managed devices.\n\n This integration involves the following components:\n\n jamf Pro server or Cloud instance\n\n EverTrust Horizon\n\n Devices to be enrolled\n\n The diagram displays these components as well as the various flows involved in an enrollment.\n\n Finally, this integration will require to setup, on Horizon side, the following elements:\n\n a jamf Connector, which holds the configuration items required for Horizon to connect to jamf Pro\n\n a jamf Profile, which holds the configuration items specifying how Horizon should issue certificates for the specified jamf Connector\n\n a jamf Scheduled Task, which holds configuration items defining the scheduled task in charge of performing revocation upon decommissioning devices from jamf Pro. This is optional.\n\n jamf Connector\n\n This section details how to configure a jamf Connector.\n\n Required By\n\n jamf Profile\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy used to reach jamf Pro, if necessary.\n\n On jamf Pro side, it is required to create a technical user for Horizon, and give it Auditor rights, so that Horizon will be able to list the devices managed by jamf Pro and thus be able to trigger certificate revocation upon decommissioning. Please follow the steps from the jamf Pro documentation . After performing these steps, you will be given the following information, required later:\n\n a login\n\n a password\n\n How to configure jamf Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access jamf Connector from the drawer or card: Third Parties > Jamf > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Jamf endpoint URL * (string input) :\n\nEnter the URL pointing to the jamf deployment or the jamf Cloud instance.\n\n Login * (string input) :\n\nEnter the username created for Horizon in jamf.\n\n Password * (string input) :\n\nEnter the password associated with aforementioned username.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy used to reach jamf Pro, if any.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be a valid finite duration.\n\n Actors management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default to 3.\n\n 5. Click on the save button.\n\n You can update or delete the jamf Connector.\n\n You won’t be able to delete a jamf Connector if it is referenced in any other configuration element.\n\n jamf Profile\n\n This section details how to configure a jamf Profile\n\n Prerequisites\n\n jamf Connector\n\n PKI Connector\n\n SCEP Authorities\n\n The SCEP Authority setup requires you to issue a certificate from the underlying PKI with the following characteristics:\n\n to issue certificates for iOS:\n\n the issuing CA should be the same as the one that will issue certificates through the PKI Connector that will be linked to the jamf Profile\n\n the certificate key usages must include Digital Signature and Key Encipherment\n\n the certificate must be issued as PKCS#12 and then imported into Horizon\n\n to issue certificates for macOS:\n\n the certificate should be self-signed\n\n the certificate key usages must include Digital Signature and Key Encipherment\n\n the certificate must be issued as PKCS#12 and then imported into Horizon\n\n How to configure jamf Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access jamf Profiles from the drawer or card: Third Parties > Jamf > Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of an URL, it is advised to use only lower case letters and dashes.\n\n Enabled (boolean) :\n\nIs the profile enabled or not. Set at true by default.\n\n jamf Connector (select) :\n\nSelect a jamf connector previously created.\n\n PKI connector * (select) :\n\nSelect a PKI Connector previously created.\n\n Max certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Assets identification\n\n DN field containing the device UDID * (select) :\n\nField used to retrieve the Device ID. The selected field must be set to $UDID/$COMPUTERNAME on jamf side, e.g. if you select \"L\", the configured Subject DN in the SCEP profile in jamf pro must then contain L=$UDID for iOS or L=$COMPUTERNAME for macOS devices. This allows to use the automated revocation upon device decommissioning feature.\n\n SCEP protocol parameters\n\n Mode * (select) :\n\nChoose from the two modes RA or CA. To enroll certificates on iOS devices, select the RA mode. To enroll certificates on macOS , select the CA mode.\n\n SCEP Authority * (select) :\n\nSelect a SCEP Authority previously created. See Prerequisites for details.\n\n CAPS (select) :\n\nSelect one or many SCEP Capabilities from the list. If unsure, leave the default.\n\n Encryption algorithm * (select) :\n\nSelect a SCEP Encryption Algorithm algorithms from the list. If unsure, leave the default.\n\n Password policy (select) :\n\nChoose from the password policy you might have previously created. If unsure, leave the default.\n\n Renewal management\n\n Renewal period ( finite duration ) :\n\nMust be in valid finite duration.\n\n Revocation on SCEP renew *: (boolean)\n\nShould the expiring certificate be revoked upon SCEP renewal. Set by default at false.\n\n Revocation reason * (select) :\n\nSelect the reason from the list. Available only if revocation on SCEP renew at true.\n\n Self Permissions\n\n Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to revoke the certificate with no validation workflow. Set to false by default.\n\n Request Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request the revocation of the certificate. Set to false by default.\n\n Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to update the certificate with no validation workflow. Set to false by default.\n\n Request Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request certificate’s update. Set to false by default.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can update or delete the jamf Profile .\n\n You won’t be able to delete a jamf Profile if it is referenced somewhere else.\n\n Last Steps\n\n The integration between jamf Pro and Horizon can be done in the following modes:\n\n jamf Pro SCEP Proxy mode\n\n iOS SCEP Profile\n\n macOS SCEP Profile\n\n macOS SCEP Profile with Proxy\n\n In all these modes, the Challenge type to use on jamf Pro side is Dynamic-Microsoft CA , and you should point to the corresponding mscep and mscep_admin URI on Horizon side, that can be found in the jamf Profile after it has been created.\n\n Jamf Pro SCEP Proxy mode\n\n This mode requires to provide the SCEP Authority PKCS#12 to jamf Pro, so that it can be uploaded in the appropriate profile.\n\n Other than that, the configuration looks like the following on Jamf Pro side:\n\n iOS/macOS SCEP Profile\n\n On jamf Pro side, the profile configuration looks like the following:\n\n macOS SCEP Profile with Proxy\n\n This mode requires:\n\n to set up the SCEP Proxy mode on jamf Pro side\n\n to configure a profile on jamf Pro side, that looks like the following:\n\n jamf Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically on your jamf profiles, in order to manage automatic revocation upon device decommissioning.\n\n Prerequisites\n\n jamf Connector\n\n jamf Profile\n\n How to configure jamf Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access jamf Scheduled Tasks from the drawer or card: Third Parties > jamf > Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Enabled (boolean) :\n\nTells whether the Scheduled task should be enabled. Set by default at true.\n\n jamf Profile * (select) :\n\nSelect a jamf profile previously created.\n\n Target Connector * (select) :\n\nSelect an jamf connector previously created.\n\n Cron scheduling ( cron expression ) :\n\nSet to every 5 hours by default.\n\n Revoke (boolean) :\n\nSet to false by default. If true, Horizon will revoke any certificate associated to a device that has been deleted from Azure AD (and hence decommissioned).\n\n Dry run (boolean) :\n\nIf enabled, revocation actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run or update or delete the Scheduled Tasks.\n\n Intune PKCS Connector\n SCEP Authorities", - "keywords": [ - "jamf", - "pro", - "admin-guide", - "admin-guide/third-parties/jamf", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.2:admin-guide:user_informations", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "User Information", - "section": "admin-guide", - "slug": "admin-guide/user_informations", - "url": "https://docs.evertrust.fr/horizon/2.2/admin-guide/user_informations.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/user_informations.html", - "breadcrumbs": ["Horizon", "Admin guide", "User Information"], - "summary": "User Information ⚠ Deprecated: This version reached LDOS on 28/09/2024. This is the section where to find all your profile information (identifier, email, name, authentication type, role and permissions), your preferences and change your ac", - "content": "User Information\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This is the section where to find all your profile information (identifier, email, name, authentication type, role and permissions), your preferences and change your account password (local account authentication only).\n\n Profile access\n\n 1. Log in to Horizon.\n\n 2. Access your profile from the header by clicking on your account name.\n\n How to change your password\n\n 1. Profile access\n\n 2. Fill your local password and confirm it.\n\n 3. Click on the 'Change Password' button.\n\n Changing your password is only available if you are using a local account.\n\n How to change your preferences\n\n 1. Profile access\n\n 2. Change your preferences:\n\n Appearance (light/dark mode)\n\n Horizon default language\n\n 3. Click on the 'Save' button.\n\n Introduction\n Certification Authorities", - "keywords": [ - "user", - "information", - "admin-guide", - "admin-guide/user_informations", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.2:install-guide:access", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "First login", - "section": "install-guide", - "slug": "install-guide/access", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/access.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/install-guide/access.html", - "breadcrumbs": ["Horizon", "Installation", "First login"], - "summary": "First login ⚠ Deprecated: This version reached LDOS on 28/09/2024. Log in Launch a web browser Browse to https://[Horizon IP or FQDN]/ui#/login : If you don’t see any Authentication method (you should see Local if the database has been setu", - "content": "First login\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Log in\n\n Launch a web browser\n\n Browse to https://[Horizon IP or FQDN]/ui#/login :\n\n If you don’t see any Authentication method (you should see Local if the database has been setup), you must Manually create the initial user .\n\n The default administration credentials are:\n\n Login: administrator\n\n Password: horizon\n\n Specify the default administration credentials and hit the Login button:\n\nIt is highly recommended to create a dedicated administration account and delete the default one, or at least modify the default administrator password.\n\n Manually create the initial user\n\n Launch a MongoDB shell to access your database and run the following command to create the initial administrator:\n\n use horizon;\ndb.security_local_identities.insert({\"identifier\":\"administrator\",\"hash\":\"$6$8JDCzmb9XDpOwtGQ$7.kRdgIjPYR/AxPbzKsdkBH3ouCgFbqyH9csjcr5qIoIXK/f2L6bQYQRhi9sdQM4eBm8sGUdEkg.TVOQ1MRsA/\",\"name\":\"Horizon Administrator\"});\ndb.security_principals.insert({\"identifier\":\"administrator\",\"permissions\":[{\"value\":\"configuration:*\"},{\"value\":\"lifecycle:*\"}],\"roles\":[]});\ndb.security_identity_providers.insert({\"enabled\":true,\"type\":\"Local\",\"name\":\"local\",\"enabledOnUI\":true});\n\n Installing with Docker\n Troubleshooting", - "keywords": [ - "first", - "login", - "install-guide", - "install-guide/access", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.2:install-guide:docker", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Installing with Docker", - "section": "install-guide", - "slug": "install-guide/docker", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/docker.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/docker.html", - "breadcrumbs": ["Horizon", "Installation", "Installing with Docker"], - "summary": "Installing with Docker ⚠ Deprecated: This version reached LDOS on 28/09/2024. Log in to the EverTrust Docker registry: $ docker login registry.evertrust.io Pull the latest Horizon image: $ docker pull registry.evertrust.io/horizon:2.2.X The", - "content": "Installing with Docker\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Log in to the EverTrust Docker registry:\n\n $ docker login registry.evertrust.io\n\n Pull the latest Horizon image:\n\n $ docker pull registry.evertrust.io/horizon:2.2.X\n\n The Horizon Docker image ships with sensible configuration defaults. Most can be configured by injecting environment variables when running the container, like so:\n\n $ docker run \\\n -e LICENSE=\"\" \\\n -e MONGODB_URI=\"\" \\\n -e APPLICATION_SECRET=\"\" \\\n -e HOSTS_ALLOWED.0=\"\" \\\n -e HOSTS_ALLOWED.1=\"\" \\\n -p [port]:9000 \\\n registry.evertrust.io/horizon:2.2.X\n\n Here’s a full list of environment variables used by the default config:\n\n Variable\n Description\n\n LICENSE\n\n A valid Horizon license string, base64-encoded.\n\n APPLICATION_SECRET\n\n Application secret used by Horizon\n\n MONGODB_URI\n\n A valid MongoDB URI. See iaas/setup/horizon.adoc#mongo_uri_config .\n\n SSV_PASSWORD\n\n If empty, the APPLICATION_SECRET value will be used.\n\n HOSTS_ALLOWED\n\n Array of hosts. Append the array index after a dot (the nth allowed host variable name would be HOSTS_ALLOWED.n).\n\n SMTP_HOST\n\n SMTP_PORT\n\n SMTP_SSL\n\n SMTP_TLS\n\n SMTP_USER\n\n SMTP_PASSWORD\n\n Your license usually contains newline characters, that you must replace by '\\n' when setting it through the environment.\n\n Should you need to have full control over the config in the container, and assuming that you have a valid configuration according to the Administration Guide and have a license file, you can mount a folder containing the configuration to /horizon/etc :\n\n $ docker run \\\n -v [configurationPath]:/horizon/etc:rw \\\n -p [port]:9000 \\\n registry.evertrust.io/horizon:2.2.X\n\n You need to use the configuration folder’s absolute path.\n\n The configuration folder must contain the horizon.lic file.\n\n Uninstall\n First login", - "keywords": [ - "installing", - "with", - "docker", - "install-guide", - "install-guide/docker", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:access", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Initial Horizon access", - "section": "install-guide", - "slug": "install-guide/iaas/access", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/access.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/access.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Initial Horizon access" - ], - "summary": "Initial Horizon access ⚠ Deprecated: This version reached LDOS on 28/09/2024. Starting the Horizon services Access the server through SSH with an account with administrative privileges; Start the horizon service with the following command: ", - "content": "Initial Horizon access\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Starting the Horizon services\n\n Access the server through SSH with an account with administrative privileges;\n\n Start the horizon service with the following command:\n\n $ systemctl start horizon\n\n Start the nginx service with the following command:\n\n $ systemctl start nginx\n\n You can now continue to First login to log in to the web UI.\n\n Server Authentication Certificate\n Standard procedure", - "keywords": [ - "initial", - "horizon", - "access", - "install-guide", - "install-guide/iaas/access", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:backup", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Backup and Restore", - "section": "install-guide", - "slug": "install-guide/iaas/backup", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/backup.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/backup.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Backup and Restore" - ], - "summary": "Backup and Restore ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how to back-up and restore Horizon. Back-up and restore operation can be performed using the back-up and restore tool available under /opt/horizo", - "content": "Backup and Restore\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how to back-up and restore Horizon. Back-up and restore operation can be performed using the back-up and restore tool available under /opt/horizon/sbin/horizon-backup . It is designed to be used only in RPM-Based deployments.\n\n For Docker or Kubernetes based deployments, the configuration should be managed by the Docker/Kubernetes management platform, and the database should be backed-up using MongoDB tools.\n\n Backup Procedure\n\n This section details how to back up Horizon configuration elements.\n\n Several elements can be backed up:\n\n The Horizon configuration files.\n\n The Horizon MongoDB.\n\n The backup tool allows backing up these elements independently.\n\n $ /opt/horizon/sbin/horizon-backup --help\n usage: horizon-backup [-cdho:qs]\n -c | --conf Backup the configuration files\n -d | --db Backup the MongoDB database\n -h | --help Display the 'horizon-backup' help\n -o | --output [path] Specify the backup output folder (default: '/opt/horizon/var/backup')\n -q | --quiet Quiet mode\n\n To back up the configuration files, run the following command:\n\n $ /opt/horizon/sbin/horizon-backup -c\n\n The configuration files backup consists of a compressed archive ( .tar.gz ) located under /opt/horizon/var/backup/ .\n\n To back up the MongoDB database, run the following command:\n\n $ /opt/horizon/sbin/horizon-backup -d\n\n The MongoDB database backup consists of a compress file ( .gz ) located under /opt/horizon/var/backup/ .\n\n To run a complete backup, execute the following command:\n\n $ /opt/horizon/sbin/horizon-backup -c -d\n\n The backup output folder can be overridden using the -o | --output parameter\n\n The backup tool can operate in quiet mode (when scheduled in a cron job) using the -q | --quiet parameter\n\n Restoration Procedure\n\n This section details how to restore horizon configuration elements.\n\nThis restore procedure only applies to the exact same application version as the backup file.\n\n Restoration operation should be performed while the Horizon service is not running. Stop the Horizon service with the following command:\n\n $ systemctl stop horizon\n\n To restore a configuration backup, run the following command:\n\n $ tar xzpvf [horizon configuration backup archive path] -C/\n\n To restore the MongoDB database, run the following command:\n\n $ mongorestore --uri=\"[MongoDB URI]\" --drop --gzip --archive=[horizon MongoDB backup archive path]\n\n The MongoDB URI can be retrieved from the /etc/default/horizon/_* configuration file, as MONGODB_URI parameter.\n\n The Horizon service can now be started with the following command:\n\n $ systemctl start horizon\n\n Upgrading from a version prior to 2.1.0\n Uninstallation", - "keywords": [ - "backup", - "and", - "restore", - "install-guide", - "install-guide/iaas/backup", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:doctor", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Horizon Doctor", - "section": "install-guide", - "slug": "install-guide/iaas/doctor", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/doctor.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/doctor.html", - "breadcrumbs": ["Horizon", "Horizon Doctor"], - "summary": "Horizon Doctor ⚠ Deprecated: This version reached LDOS on 28/09/2024. Horizon doctor is a tool that performs checks on your Horizon installation as well as its required dependencies to ensure that everything is configured properly. The tool", - "content": "Horizon Doctor\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Horizon doctor is a tool that performs checks on your Horizon installation as well as its required dependencies to ensure that everything is configured properly.\nThe tool is targeted towards troubleshooting during installation or update procedures.\nNote that the tool requires root permissions to run.\n\n Performed checks\n\n At the moment, Horizon Doctor checks for:\n\n OS checks\n\n Checks for installed Horizon version, MongoDB version, Java version, Nginx version, OS Version.\n\n If the OS is a RedHat distribution, checks if the RedHat subscription is active.\n\n If Mongo is not installed locally, it notices it as an information log.\n\n Checks for SELinux 's configuration: throws a warning if it is enabled, says ok if it is on permissive or disabled.\n\n Checks for the status of the necessary services: postfix , mongod , nginx and horizon .\n\n If the postfix service is running, tries to connect via a TCP SYN on the port 25 of the relayhost specified in the /etc/postfix/main.cf file and throws an error if it can’t.\n\n Checks how long the Horizon service has been running for.\n\n Checks if there is an NTP service active on the machine and checks if the system clock is synchronized with the NTP service.\n\n Config checks\n\n Checks for existence and permissions of the configuration file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for existence and permissions of the licence file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for existence and permissions of the vault file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for the permission of the Horizon directory (default: /opt/horizon): the permission is expected to be at least 755.\n\n Checks for the existence of the symbolic link for nginx configuration and runs an nginx -t test.\n\n Retrieves the Java heap size parameters that were set for Horizon and throws a warning if the default ones are used (min = 2048 and max = 3072).\n\n Retrieves the Horizon DNS hostname and stores it for a later test (throws an error if it has not been set).\n\n Checks for the Horizon Play Secret and Horizon Event Seal Secret : these are the Horizon application secrets and should be different from default value thus Horizon Doctor throws an error if either of them is equal to the default value ( changeme ).\n\n Retrieves the MongoDB URI (throws a warning if MongoDB is running on localhost; throws an error if MongoDB is running on an external instance but the authSource=admin parameter is missing from the URI).\n\n Parses the Horizon licence file to retrieve its expiration date as well as the licence details (number of holders per category).\n\n Network checks\n\n Runs a MongoDB ping on the URI, then checks for the database used in the URI (throws a warning if the database used is not called horizon ; throws an error if no database is specified in the URI).\n\n Checks for AKKA High Availability settings: if no node hostname is set up, skips the remaining HA checks. If 2 nodes are set up, retrieves which node is running the doctor and checks for the other node. If 3 nodes are set up, retrieves which node is running the doctor and checks for the other 2 nodes.\nThe check runs as:\n\n if curl is installed, runs a curl request on the Node hostname at alive on the management port (default is 8558), and if alive runs another curl request on the Node hostname at /ready on the management port. Both requests should return HTTP/200 if ok, 000 otherwise.\n\n if curl is not installed, uses the built-in Linux TCP socket to run TCP SYN checks on both the HA communication port (default is 25520) and the management port (default is 8558) on the Node hostname.\n\n Checks for firewall configuration . Currently only supports firewalld (RHEL) and a netstat test.\n\n The netstat part will run a netstat command to check if the JVM listening socket is active (listening on port 9000). If netstat is not installed, it will skip this test.\n\n The firewalld part will check if the HTTP and HTTPS services are opened in the firewall and if it detected a HA configuration, it will check if the HA ports (both of them) are allowed through the firewalld. If firewalld is not installed or not active, it will skip this test.\n\n Checks if IPv6 is active in every network interface and throws a warning if it is the case (specifying the interface with IPv6 turned on).\n\n TLS checks\n\n Checks for existence and permissions of the Horizon server certificate file: the permissions are expected to be at least 640 and the file is supposed to belong to the nginx group.\n\n Parses the Horizon server certificate file: it should be constituted of the actual TLS server certificate first, then of every certificate of the trust chain (order being leaf to root). It throws a warning if the certificate is self-signed or raises an error if the trust chain has not been imported. It otherwise tries to reconstitute the certificate trust chain via the openssl verify command, and throws an error if it cannot.\n\n Parses the Horizon server certificate file and checks if the Horizon hostname is present in the SAN DNS names of the certificate, throws an error if it is not there.\n\n Log packing option\n\n If the Horizon doctor is launched with the -l option , it will pack the logs of the last 7 days (in /opt/horizon/var/log ) as well as the startup logs (the /var/log/horizon/horizon.log file) and create a tar archive.\n\n The -l option accepts an optional parameter that should be an integer (1-99) and will pack the logs of the last n days instead, as well as the startup logs.\n\n Note that the Horizon doctor will still perform all of its check; the log packing is done at the very end of the program.\n\n Example of call to pack the logs of the last 7 days:\n\n $ horizon-doctor -l\n\n Example of call to pack the logs of the last 30 days:\n\n $ horizon-doctor -l 30\n\n Saving the doctor’s output\n\n If the Horizon doctor is launched with the -o option , it will perform all of its checks and save the output in the specified file instead of displaying it into the stdout (default is the command line interface).\n\n If you use the option, you must provide a filepath in a writable directory.\n\n Example of call to save the output in a file named horizon-doctor.out instead of the stdout :\n\n $ horizon-doctor -o horizon-doctor.out\n\n Help menu\n\n To display Horizon doctor’s help menu, use the -h option.", - "keywords": [ - "horizon", - "doctor", - "install-guide", - "install-guide/iaas/doctor" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:installation:firewall", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Configuring the Firewall", - "section": "install-guide", - "slug": "install-guide/iaas/installation/firewall", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/installation/firewall.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/firewall.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Configuring the Firewall" - ], - "summary": "Configuring the Firewall ⚠ Deprecated: This version reached LDOS on 28/09/2024. Access the server through SSH with an account with administrative privileges; Open port TCP/443 on the local firewall with the following command: $ firewall-cmd", - "content": "Configuring the Firewall\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Access the server through SSH with an account with administrative privileges;\n\n Open port TCP/443 on the local firewall with the following command:\n\n $ firewall-cmd --permanent --add-service=https\n\n Reload the firewall configuration with:\n\n $ systemctl restart firewalld\n\n Installing Horizon\n Initial Configuration", - "keywords": [ - "configuring", - "the", - "firewall", - "install-guide", - "install-guide/iaas/installation/firewall", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:installation:horizon", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Installing Horizon", - "section": "install-guide", - "slug": "install-guide/iaas/installation/horizon", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/installation/horizon.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/horizon.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Installing Horizon" - ], - "summary": "Installing Horizon ⚠ Deprecated: This version reached LDOS on 28/09/2024. Installation from the EverTrust repository Create a /etc/yum.repos.d/horizon.repo file containing the EverTrust repository info: [horizon] enabled=1 name=Horizon Repo", - "content": "Installing Horizon\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Installation from the EverTrust repository\n\n Create a /etc/yum.repos.d/horizon.repo file containing the EverTrust repository info:\n\n [horizon]\nenabled=1\nname=Horizon Repository\nbaseurl=https://repo.evertrust.io/repository/horizon-rpm/\ngpgcheck=0\nusername=<username>\npassword=<password>\n\n Replace <username> and <password> with the credentials you were provided.\n\n You can then run the following to install the latest Horizon version:\n\n $ yum install horizon\n\n To prevent unattended upgrades when running yum update, you should pin the Horizon version by adding\n\n exclude=horizon\n\n at the end of the /etc/yum.repos.d/horizon.repo file after installing Horizon.\n\n Installing from RPM\n\n Upload the file horizon-2.2.X-1.noarch.rpm through SCP under /root .\n\n Access the server through SSH with an account with administrative privileges;\n\n Install the Horizon package with the following command:\n\n $ yum localinstall /root/horizon-2.2.X-1.noarch.rpm\n\n Installing the Horizon package will install the following dependencies:\n\n dialog\n\n java-11-openjdk-headless\n\n Please note that these packages may have their own dependencies.\n\n Installing NGINX\n Configuring the Firewall", - "keywords": [ - "installing", - "horizon", - "install-guide", - "install-guide/iaas/installation/horizon", - "installation", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:installation:mongodb", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Installing MongoDB", - "section": "install-guide", - "slug": "install-guide/iaas/installation/mongodb", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/installation/mongodb.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/mongodb.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Installing MongoDB" - ], - "summary": "Installing MongoDB ⚠ Deprecated: This version reached LDOS on 28/09/2024. Mongo DB version 4.2.x to 5.0.x are supported by Horizon Download the latest version of the following Mongo DB 5.x RPMs from the MongoDB web site : mongodb-org mongod", - "content": "Installing MongoDB\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\nMongo DB version 4.2.x to 5.0.x are supported by Horizon\n\n Download the latest version of the following Mongo DB 5.x RPMs from the MongoDB web site :\n\n mongodb-org\n\n mongodb-org-mongos\n\n mongodb-org-server\n\n mongodb-org-shell\n\n mongodb-org-tools\n\n Download the last version of the mongosh RPM from the MongoDB GitHub .\n\n mongodb-mongosh\n\n Upload the downloaded RPMs through SCP on the server under /root .\n\n Using an account with privileges, install the RPMs using 'yum'. For example, to install MongoDB version 5.0.1, run the following command from the folder containing the RPMs:\n\n $ yum install mongodb-org*\n$ yum install mongodb-mongosh\n\n Enable the service at startup with the following command:\n\n $ systemctl enable mongod\n\n Start the mongod service with the following command:\n\n $ systemctl start mongod\n\n Verify that you can connect to the Mongo instance by running the mongo shell:\n\n $ mongo\n\nYou can disconnect from the shell with ^D\n\n Pre-requisites\n Installing NGINX", - "keywords": [ - "installing", - "mongodb", - "install-guide", - "install-guide/iaas/installation/mongodb", - "horizon", - "installation", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:installation:nginx", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Installing NGINX", - "section": "install-guide", - "slug": "install-guide/iaas/installation/nginx", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/installation/nginx.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/nginx.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Installing NGINX" - ], - "summary": "Installing NGINX ⚠ Deprecated: This version reached LDOS on 28/09/2024. Access the server through SSH with an account with administrative privileges; Install the NGINX web server using the following command: $ yum install nginx Enable NGINX", - "content": "Installing NGINX\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Access the server through SSH with an account with administrative privileges;\n\n Install the NGINX web server using the following command:\n\n $ yum install nginx\n\n Enable NGINX to start at boot using the following command:\n\n $ systemctl enable nginx\n\n Stop the NGINX service with the following command:\n\n $ systemctl stop nginx\n\n Installing MongoDB\n Installing Horizon", - "keywords": [ - "installing", - "nginx", - "install-guide", - "install-guide/iaas/installation/nginx", - "horizon", - "installation", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:prerequisites", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Pre-requisites", - "section": "install-guide", - "slug": "install-guide/iaas/prerequisites", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/prerequisites.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/prerequisites.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Pre-requisites" - ], - "summary": "Pre-requisites ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section describes the system and software pre-requisites to install Horizon. System pre-requisites The following elements are considered as system pre-requisites: A ", - "content": "Pre-requisites\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section describes the system and software pre-requisites to install Horizon.\n\n System pre-requisites\n\n The following elements are considered as system pre-requisites:\n\n A server running EL [7.x-8.x] x64 (CentOS / RHEL) with the network configured and SELinux disabled;\n\n Base and EPEL CentOS / RHEL [7.x-8.x] x64 repositories activated;\n\n An access with administrative privileges (root) to the server mentioned above;\n\n The IP address / DNS Name of an SMTP relay;\n\n The email address of the Horizon server administrator.\n\n Software pre-requisites\n\n The following elements are considered as software pre-requisites:\n\n The Horizon installation package: horizon-2.2.X-1.noarch.rpm ;\n\n The MongoDB Community Edition package available from the MongoDB web site ;\n\n EPEL repository activated.\n\n As a reminder, EPEL can be activated on CentOS / RHEL by doing the following:\n\n $ yum install epel-release\n\n Introduction\n Installing MongoDB", - "keywords": [ - "pre-requisites", - "install-guide", - "install-guide/iaas/prerequisites", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:setup:horizon", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Initial Configuration", - "section": "install-guide", - "slug": "install-guide/iaas/setup/horizon", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/setup/horizon.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/setup/horizon.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Configuration", - "Initial Configuration" - ], - "summary": "Initial Configuration ⚠ Deprecated: This version reached LDOS on 28/09/2024. Configuring the SMTP Relay Access the server through SSH with an account with administrative privileges; Run the Horizon Configuration Utility with the following c", - "content": "Initial Configuration\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Configuring the SMTP Relay\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' SMTP ':\n\n Specify IP address or the DNS name of the SMTP relay and validate:\n\n The Postfix configuration is updated:\n\n Exit the configuration utility and restart the Postfix service with the following command:\n\n $ systemctl restart postfix\n\n Configuring the Horizon Administrator’s Email Address\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select Administrator :\n\n Specify the email address of the Horizon Administrator and validate:\n\n Exit the Configuration Utility;\n\n Validate the SMTP relay and Administrator Email Address with the following commands:\n\n $ yum install mailx\n$ mail -s \"Hello Horizon root\"\n > Hello From Horizon\n .\n\n Ensure that the email receives the test email.\n\n Generating a new Horizon Application Secret\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $/opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Akka_Play ':\n\n In the Akka_Play menu, select ' SECRET ':\n\n Validate the new Horizon Application Secret:\n\n The Horizon configuration is updated:\n\n JVM Configuration\n\n Horizon allows you to configure the xms (minimum memory allocation pool) and xmx (maximum memory allocation pool) parameters of the JVM running Horizon using the configuration tool.\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the configuration menu, select ' Horizon ':\n\n In the Horizon configuration menu, Select ' JVM ':\n\n Specify the 2048 for xms and 3072 for xmx parameters and select ' OK ':\n\n The new JVM parameters are configured:\n\n MongoDB URI Configuration\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select Horizon :\n\n In the Horizon configuration menu, Select MONGODB_URI :\n\n Specify the MongoDB URI to target your MongoDB instance:\n\n Horizon is installed to target a local MongoDB instance by default.\n\n If you use an external MongoDB (such as MongoDB Atlas Database or dedicated On-premises database) instance:\n\n Create a user with \"read/write\" permissions on your MongoDB instance;\n\n Create a replicaSet if using a MongoDB cluster;\n\n Specify a MongoDB URI that does match your context.\n\n External MongoDB database URI syntax:\n mongodb+srv://<user>:<password>@<Mongo-DB-hostname>:<Mongo-DB-Port>/horizon\n\n External MongoDB cluster of databases URI syntax:\n mongodb+srv://<user>:<password>@<Mongo-DB-hostname-1>,<Mongo-DB-hostname-2>:<Mongo-DB-Port>/horizon?replicaSet=<Horizon-ReplicaSet-Name>&authSource=admin\n\n The MongoURI is configured:\n\n Horizon Hostname Configuration\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon configuration menu, Select HORIZON_HOSTNAME :\n\n Specify the DNS FQDN by which Horizon will be accessed:\n\n The Horizon Hostname is configured:\n\n Generating an event seal secret\n\n Horizon will generate functional events when using the software.\n\n These events are typically signed and chained to ensure their integrity. Therefore, you must specify a sealing secret for this feature to work correctly.\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon menu, select ' HORIZON_SEAL_SECRET ':\n\n Validate the new event seal secret:\n\n The event seal secret is now configured :\n\n Installing the Horizon license\n\n You should have been provided with a ' horizon.lic ' file. This file is a license file and indicates:\n\n The horizon entitled module(s)\n\n The limitation in terms of holder per module if any\n\n A end of support date\n\n Upload the horizon.lic file through SCP under /tmp/horizon.lic ;\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon configuration menu, Select ' HORIZON_LICENSE ':\n\n Specify the path /tmp/horizon.lic and validate:\n\n The Horizon License is configured:\n\n Restart the horizon service using the following command:\n\n $ systemctl restart horizon\n\n Horizon Vault Key configuration\n\n Horizon stored sensitive data in a secure way using encryption.\n\n Horizon masterkey can be derived from:\n\n Software key;\n\n HSM stored key using (PKCS#11 compatible HSMs are supported);\n\n Azure Key Vault stored key;\n\n Hashicorp vault stored key;\n\n FCMS vault stored key.\n\n Please refer to the proper section according to your setup.\n\n Horizon SSV key Configuration (Software)\n\nThis section must not be followed if you use another vault than the default one.\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon configuration menu, Select ' HORIZON_SSV_KEY ':\n\n Specify the master key that will be used:\n\n Horizon masterkey is configured:\n\n Restart the horizon service using the following command:\n\n $ systemctl restart horizon\n\n HSM vault Configuration\n\n Horizon supports PKCS#11 compatible HSM vaults .\n\nThis section must not be followed if you use another vault than the HSM vault.\n\n HSM middleware should be properly installed and HSM slot initialization should be done using the tools provided by the HSM provider.\n\"horizon\" linux user should be member of the proper HSM linux management group to perform cryptographic operations ('nfast' for nCipher nShield HSM or 'hsmusers' for Luna HSM for example).\n\n Access the server through SSH with an account with administrative privileges;\n\n Create a vaults.conf configuration file in /opt/horizon/etc/conf.d directory with the following content to configure the HSM vault:\n\n default {\n module_path = \"\"\n slot_id = \"\"\n pin = \"\"\n label = \"\"\n allow_master_key_gen = true\n}\n\n module_path : The path to the PKCS#11 library (string between double quotes);\n\n slot_id : ID of the Slot on the PKCS#11 Module (string between double quotes);\n\n pin : The PIN used to authenticate to your HSM slot (string between double quotes);\n\n label : Label of key (string between double quotes);\n\n allow_master_key_gen : Allow the masterkey to be generated by Horizon if not found in the slot.\n\n Set the permissions using the following commands:\n\n $ chown horizon:horizon /opt/horizon/etc/conf.d/vaults.conf\n\n Restart the horizon service using the following command:\n\n $ systemctl restart horizon\n\n At the end of the installation procedure:\n\n Set allow_master_key_gen value to false .\n\n Restart the horizon service.\n\n Installing Horizon on a cluster of servers\n\nThis section must not be followed if you plan on deploying Horizon in standalone mode (vs cluster mode).\nWARNING: This section does not explain how to install Horizon on a Kubernetes cluster. Please refer to the dedicated section.\n\n In the main menu, select ' Akka_Play ':\n\n In the Akka_Play menu, select ' AKKA_HA ':\n\n In this menu, specify either the IP address or the DNS name for each server that will be running Horizon on this cluster, as well as the local node index (the number of the node that you are configuring at that moment).\n\n Note that the local node index must match the Node Hostname parameter:\n\n Save your changes from the menu.\n\n The High Availability mode is now configured on the current node :\n\n You must now configure your other nodes, but because they belong to the same cluster they need to share the same secret, the same secret seal event, the same hostname and the same database .\nIn order to be able to do that, you need to copy the configuration file that was generated by the horizon-config app, named /etc/default/horizon and paste it on each one of your nodes;\n\n Then on each other node, run the Horizon Configuration utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the Akka_Play menu, select ' AKKA_HA ':\n\n Here, you need to change the local node index to match the hostname of the node that you are configuring:\n\nYou will need to import the Horizon licence file on each node manually, following the guidelines of section Installing the Horizon license .\n\n Additionally, on each node, you will need to open the ports used for Akka_HA and Akka_MGMT, which are by default 25520 and 8558:\n\n $ firewall-cmd --permanent --add-port=25520/tcp\n$ firewall-cmd --permanent --add-port=8558/tcp\n\n Reload the firewall configuration with:\n\n $ systemctl restart firewalld\n\n Restart the Horizon service on each one of the nodes:\n\n $ systemctl restart horizon\n\n Configuring the Firewall\n Server Authentication Certificate", - "keywords": [ - "initial", - "configuration", - "install-guide", - "install-guide/iaas/setup/horizon", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:setup:nginx", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Server Authentication Certificate", - "section": "install-guide", - "slug": "install-guide/iaas/setup/nginx", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/setup/nginx.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/setup/nginx.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Configuration", - "Server Authentication Certificate" - ], - "summary": "Server Authentication Certificate ⚠ Deprecated: This version reached LDOS on 28/09/2024. Issuing a Certificate Request (PKCS#10) Access the server through SSH with an account with administrative privileges; Run the Horizon Configuration Uti", - "content": "Server Authentication Certificate\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Issuing a Certificate Request (PKCS#10)\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' NGINX ':\n\n In the NGINX menu, select ' CSR ':\n\n Specify the DNS Name of the Horizon server (by default, the config script takes the Horizon hostname if defined or the local machine hostname otherwise):\n\n The certificate request is generated and available under /etc/nginx/ssl/horizon.csr.new :\n\n Sign the certificate request using your PKI.\n\n Installing a Server Certificate\n\n Upload the generated server certificate on the Horizon server under /tmp/horizon.pem through SCP;\n\n In the NGINX configuration menu, select ' CRT ':\n\n Specify the path /tmp/horizon.pem and validate:\n\n The server certificate is successfully installed:\n\n Installing the Server Certificate Trust Chain\n\n Upload the server certificate trust chain (the concatenation of the Certificate Authority certificates in PEM format) on the Horizon server under /tmp/server.bundle through SCP;\n\n In the NGINX configuration menu, select ' TC ':\n\n Specify the path /tmp/server.bundle and validate:\n\n The server bundle is successfully installed:\n\n Verify the NGINX configuration with the following command:\n\n $ nginx -t\n\n Restart the NGINX service with the following command:\n\n $ systemctl restart nginx\n\n Initial Configuration\n Initial Horizon access", - "keywords": [ - "server", - "authentication", - "certificate", - "install-guide", - "install-guide/iaas/setup/nginx", - "horizon", - "installation", - "installing", - "on", - "centos/rhel", - "configuration" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:uninstall", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Uninstallation", - "section": "install-guide", - "slug": "install-guide/iaas/uninstall", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/uninstall.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/uninstallation.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Uninstallation" - ], - "summary": "Uninstallation ⚠ Deprecated: This version reached LDOS on 28/09/2024. Before uninstalling, please make sure that you have a proper backup of the Horizon component . Once uninstalled, all the Horizon data will be irremediably lost ! Uninstal", - "content": "Uninstallation\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\nBefore uninstalling, please make sure that you have a proper backup of the Horizon component . Once uninstalled, all the Horizon data will be irremediably lost !\n\n Uninstalling Horizon consists of uninstalling:\n\n The Horizon service;\n\n The MongoDB service;\n\n The NGINX service.\n\n Uninstalling Horizon\n\n Access the server through SSH with an account with administrative privileges;\n\n Uninstall Horizon with the following commands:\n\n $ systemctl stop horizon\n$ yum remove horizon\n$ rm -rf /opt/horizon\n$ rm -rf /var/log/horizon\n$ rm -f /etc/default/horizon\n\n Uninstalling NGINX\n\n Access the server through SSH with an account with administrative privileges;\n\n Uninstall NGINX with the following commands:\n\n $ systemctl stop nginx\n$ yum remove nginx\n$ rm -rf /etc/nginx\n$ rm -rf /var/log/nginx\n\n Uninstalling MongoDB\n\n Access the server through SSH with an account with administrative privileges;\n\n Uninstall MongoDB with the following commands:\n\n $ systemctl stop mongod\n$ rpm -qa | grep -i mongo | xargs rpm -e\n$ rm -rf /var/log/mongodb\n$ rm -rf /var/lib/mongodb\n\n Backup and Restore\n Installation", - "keywords": [ - "uninstallation", - "install-guide", - "install-guide/iaas/uninstall", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:upgrade:2.1.0", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Upgrading from a version prior to 2.1.0", - "section": "install-guide", - "slug": "install-guide/iaas/upgrade/2.1.0", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/upgrade/2.1.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.6/install-guide/iaas/upgrade/2.1.0.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Upgrade", - "Upgrading from a version prior to 2.1.0" - ], - "summary": "Upgrading from a version prior to 2.1.0 ⚠ Deprecated: This version reached LDOS on 28/09/2024. These instructions should be followed if you upgrade from a version prior to 2.1.0 to any version greater or equal to 2.1.0. These steps should b", - "content": "Upgrading from a version prior to 2.1.0\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n These instructions should be followed if you upgrade from a version prior to 2.1.0 to any version greater or equal to 2.1.0.\n\n These steps should be followed in addition to the common upgrade procedure found in Standard Procedure . None of these steps are automated by horizon-upgrade .\n\n Setting an event seal secret\n\n You must manually create an entry to pass an event seal secret to Horizon in the /etc/default/horizon file. horizon-config won’t do that automatically.\n\n To do so, open the /etc/default/horizon file with a text editor :\n\n $ vi /etc/default/horizon\n\n And add a new line under the Horizon variables section :\n\n # Horizon variables\nHORIZON_NOTIFICATION_SMTP_HOST=127.0.0.1\nHORIZON_HOSTNAME=\nHORIZON_DEFAULT_SSV_KEY=\nHORIZON_EVENT_SEAL_SECRET=changeme # <- this one\n\n Then, near the end of the file, after the # Setting Horizon Mongo DB uri section, create a new section for the event seal secret:\n\n # Setting the Horizon event seal secret\nJAVA_OPTS=\"$JAVA_OPTS -Dhorizon.event.seal.secret=${HORIZON_EVENT_SEAL_SECRET}\"\n\n Horizon won’t boot if the HORIZON_EVENT_SEAL_SECRET is set to changeme . Therefore, you should set your secret to something hard to guess.\nRefer to the Initial Configuration guide to learn how to generate a seal secret with horizon-config .\n\n Standard procedure\n Backup and Restore", - "keywords": [ - "upgrading", - "from", - "version", - "prior", - "to", - "install-guide", - "install-guide/iaas/upgrade/2", - "horizon", - "installation", - "installing", - "on", - "centos/rhel", - "upgrade" - ] - }, - { - "page_id": "horizon:2.2:install-guide:iaas:upgrade:upgrade", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Standard Procedure", - "section": "install-guide", - "slug": "install-guide/iaas/upgrade/upgrade", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/iaas/upgrade/upgrade.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.6/install-guide/iaas/upgrade/upgrade.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Upgrade", - "Standard procedure" - ], - "summary": "Standard Procedure ⚠ Deprecated: This version reached LDOS on 28/09/2024. The current instructions refer to the standard upgrade procedure. Additional steps might be required, please refer to release notes. Upgrade the horizon installation ", - "content": "Standard Procedure\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n The current instructions refer to the standard upgrade procedure.\nAdditional steps might be required, please refer to release notes.\n\n Upgrade the horizon installation\n\n You must retrieve the latest Horizon RPM from the EverTrust repository manually using the user credentials you were provided.\n\n Access the server through SSH with an account with administrative privileges;\n\n Install the Horizon package with the following command:\n\n $ yum install horizon-2.2.X-1.noarch.rpm`\n\n Upgrade the database schema\n\n Some Horizon versions require that you run migration scripts against your database.\nSince version 2.1.0, Horizon comes bundled with an horizon-upgrade script that handles this migration logic.\n\n Therefore, after each upgrade, you should run horizon-upgrade to check whether new migrations should be run.\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the following command:\n\n $ /opt/horizon/sbin/horizon-upgrade -t <target version>\n\n In most cases, horizon-upgrade can detect the version you’re upgrading from by checking the database. However, when upgrading from version prior to 2.1.0, you will encounter the following error:\n\n *** Unable to infer the source version from your database. Specify it explicitly with the -s flag. ***\n\n You’ll have to explicitly tell horizon-upgrade which version you are upgrading from. To do that, simply set the source version explicitly with the -s flag :\n\n $ /opt/horizon/sbin/horizon-upgrade -t <target version> -s <source version>\n\n Similarly, horizon-upgrade will try to use the MongoDB URI that was configured by the Horizon configuration utility. If it fails to auto-detect your database URI or you wish to migrate another database, specify the URI explicitly using the -m flag:\n\n $ /opt/horizon/sbin/horizon-upgrade -t <target version> -m \"<mongo uri>\"\n\n The upgrade script requires a MongoDB client to connect to your database (either mongo or mongosh ). If no client is installed on the host where Horizon is running, consider installing the standalone mongosh client or running the upgrade script from another host that has access to the database.\n\n Initial Horizon access\n Upgrading from a version prior to 2.1.0", - "keywords": [ - "standard", - "procedure", - "install-guide", - "install-guide/iaas/upgrade/upgrade", - "horizon", - "installation", - "installing", - "on", - "centos/rhel", - "upgrade" - ] - }, - { - "page_id": "horizon:2.2:install-guide:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Introduction", - "section": "install-guide", - "slug": "install-guide/introduction", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/introduction.html", - "breadcrumbs": ["Horizon", "Installation", "Introduction"], - "summary": "Introduction ⚠ Deprecated: This version reached LDOS on 28/09/2024. Description Horizon is EverTrust Certificate lifecycle management solution. This document is an installation procedure detailing how to install and bootstrap Horizon server", - "content": "Introduction\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Description\n\n Horizon is EverTrust Certificate lifecycle management solution. This document is an installation procedure detailing how to install and bootstrap Horizon server on your infrastructure. It does not describe how to configure and operate a Horizon instance. Please refer to the administration guide for administration related tasks.\n\n Prerequisites\n\n Choose an installation method\n\n We offer two installation modes:\n\n A package-based installation on a server running CentOS/RHEL 7.x/8.x x64\n\n A cloud-native installation using Kubernetes\n\n Depending on your needs, you’ll have to choose the solution that fits your use cases the best. Reach out to our support team to get suggestions on how to deploy on your infrastructure.\n\n Gathering your credentials\n\n Both methods require that you download the binaries of the Horizon software from our software repository . The access to this repository is protected by username and password, which you should have got from our tech team. If you don’t, you won’t be able to continue with the installation. Email us to get your credentials, and come back to this step.\n\n Pre-requisites", - "keywords": [ - "introduction", - "install-guide", - "install-guide/introduction", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.2:install-guide:k8s:installation", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Installation", - "section": "install-guide", - "slug": "install-guide/k8s/installation", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/k8s/installation.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/k8s/installation.html", - "breadcrumbs": ["Horizon", "Installation", "Installing on Kubernetes"], - "summary": "Installation ⚠ Deprecated: This version reached LDOS on 28/09/2024. Concepts overview In Kubernetes, applications are deployed onto Pods , which represents a running version of a containerized application. Pods are grouped by Deployments , ", - "content": "Installation\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Concepts overview\n\n In Kubernetes, applications are deployed onto Pods , which represents a running version of a containerized application. Pods are grouped by Deployments , which represent a set of Pods running the same application. For instance, should you need to run Horizon in high availability mode, your deployment will contain 3 pods or more. Applications running in Pods are made accessible by a Service , which grants a set of Pods an IP address (which can either be internal to the cluster or accessible on the public Internet through a Load Balancer).\n\n The recommended way of installing on Horizon is through the Horizon’s Helm Chart. Helm is a package manager for Kubernetes that will generate Kubernetes resources necessary to deploy Horizon onto your cluster. The official Helm Chart will generate a deployment of one or more Pods running Horizon on your cluster.\n\n Setting up Helm repository\n\n Now that the application secrets are configured, add the EverTrust Helm repository to your machine:\n\n $ helm repo add evertrust https://repo.evertrust.io/repository/charts\n\n Verify that you have access to the Chart :\n\n $ helm search repo evertrust/horizon\nNAME CHART VERSION\tAPP VERSION\tDESCRIPTION\nevertrust/horizon 0.5.3 2.2.2 EverTrust Horizon Helm chart\n\n Configuring the namespace\n\n For isolation purposes, we strongly recommend that you create a dedicated namespace for Horizon :\n\n $ kubectl create namespace horizon\n\n The namespace should be empty. In order to run Horizon, you’ll need to create two secrets in that namespace:\n\n A license secret containing your Horizon license file\n\n An image pull secret, allowing Kubernetes to authenticate to the EverTrust’s container repository\n\n Creating the license secret\n\n You should have a license file for your Horizon installation, most probably named horizon.lic . To convert this file to a Kubernetes secret, run:\n\n $ kubectl create secret generic horizon-license \\\n --from-file=license=\"<path to your license file>\" \\\n --namespace horizon\n\n Creating the image pull secret\n\n Next, you should configure Kubernetes to authenticate to the EverTrust repository using your credentials. They are necessary to pull the Horizon docker image, you should have received them upon purchase. Get your username and password and create the secret:\n\n $ kubectl create secret docker-registry evertrust-registry \\\n --docker-server=registry.evertrust.io \\\n --docker-username=\"<your username>\" \\\n --docker-password=\"<your password>\" \\\n --namespace horizon\n\n Configuring the chart\n\n You’ll next need to override the defaults values.yaml file of the Helm Chart to reference the secrets that we’ve created. We’ll provide a minimal configuration for demonstration purposes, but please do follow our production setup guide before deploying for production.\n\n Create a override-values.yaml file somewhere and paste this into the file:\n\n image:\n pullSecrets:\n - evertrust-registry\n\nlicense:\n secretName: horizon-license\n secretKey: license\n\n To finish Horizon’s installation, simply run the following command:\n\n $ helm install horizon evertrust/horizon -f override-values.yaml -n horizon\n\n Please allow a few minutes for the Horizon instance to boot up. You are now ready to go on with the First login .\nThis instance will allow you to test out if Horizon is working correctly on your cluster. However, this installation is not production-ready. Follow our Production checklist to make sure your instance is fit to run in your production environment.\n\n Uninstallation\n Production checklist", - "keywords": [ - "installation", - "install-guide", - "install-guide/k8s/installation", - "horizon", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.2:install-guide:k8s:production", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Production checklist", - "section": "install-guide", - "slug": "install-guide/k8s/production", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/k8s/production.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/k8s/production.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Production checklist" - ], - "summary": "Production checklist ⚠ Deprecated: This version reached LDOS on 28/09/2024. Even though the Helm Chart makes installing Horizon a breeze, you’ll still have to set up a few things to make Horizon resilient enough to operate in a production e", - "content": "Production checklist\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Even though the Helm Chart makes installing Horizon a breeze, you’ll still have to set up a few things to make Horizon resilient enough to operate in a production environment.\n\n Operating the database\n\n All persistent data used by Horizon is stored in the underlying MongoDB database. Therefore, the database should be operated securely and backed up regularly.\n\n When installing the chart, you face multiple options regarding your database :\n\n By default, a local MongoDB standalone instance will be spawned in your cluster, using the bitnami/mongodb chart. No additional configuration is required but it is not production ready out of the box. You can configure the chart as you would normally below the mongodb key:\n\n mongodb:\n architecture: replicaset\n # Any other YAML value from the chart docs\n\n If you want to use an existing MongoDB instance, provide the externalDatabase.uri value. The URI should be treated as a secret as it must include credentials:\n\n externalDatabase:\n uri:\n valueFrom:\n secretKeyRef:\n name: <secret name>\n key: <secret key>\n\n The chart doesn’t manage the database. You are still in charge of making sure that the database is correctly backed up. You could either back up manually using mongodump or use a managed service such as MongoDB Atlas , which will take care of the backups for you.\n\n Managing secrets\n\n Storing secrets is a crucial part of your Horizon installation. On cloud-native installations like on Kubernetes, we recommend using SSV (Secure Software Vault) to encrypt sensitive data: a master passphrase will be used to encrypt and decrypt data before they enter the database. Alongside with other application secrets like your MongoDB URI (containing your credentials or certificate).\nWe recommend that you create Kubernetes secrets beforehand or inject them directly into the pod.\n\n Values that should be treated as secrets in this chart are:\n\n Name\n Description\n Impact on loss\n\n vaults.*.master_password\n\n SSV password used to encrypt sensitive data in database.\n\n Highest impact: database would be unusable\n\n events.secret\n\n Secret used to sign and chain events.\n\n Moderate impact: events integrity would be unverifiable\n\n externalDatabase.uri\n\n External database URI, containing a username and password.\n\n Low impact: reset the MongoDB password\n\n appSecret\n\n Application secret use to encrypt session data.\n\n Low impact: sessions would be reset\n\n mailer.password\n\n SMTP server password\n\n Low impact: reset the SMTP password\n\n For each of these values, either :\n\n leave the field empty, so that a secret will be automatically generated.\n\n derive the secret value from an existing Kubernetes secret :\n\n appSecret:\n valueFrom:\n secretKeyRef:\n name: <secret name>\n key: <secret key>\n\nAlways store auto-generated secrets in a safe place after they’re generated. If you ever uninstall your Helm chart, the deletion of the SSV secret will lead to the impossibility of recovering most of your data.\n\n High availability\n\n By default, the chart will configure a single-pod deployment. This deployment method is fine for testing but not ready for production as a single failure could take down the entire application. Instead, we recommend that you set up a Horizon cluster using at least 3 pods.\n\n In order to do that, configure an horizontalAutoscaler in your override-values.yaml file:\n\n horizontalAutoscaler:\n enabled: true\n minReplicas: 3\n maxReplicas: 3\n\nUse nodeAffinity to spread your Horizon cluster Pods among multiple nodes in different availability zones to reduce the risk of Single Point of Failure.\n\n Configuring ingresses\n\n To create an ingress upon installation, simply set the following keys in your override-values.yaml file:\n\n ingress:\n enabled: true\n hostname: horizon.lab\n tls: true\n\n We support autoconfiguration for major ingress controllers: Kubernetes Ingress NGINX and Traefik. Autoconfiguration is the recommended way of configuring your ingress as it will handle configuration quirks for you. To enable autoconfiguration, set the type key to your ingress controller in the ingress definition. Accepted values are nginx and traefik .\n\n ingress:\n enabled: true\n type: \"\" # nginx or traefik\n clientCertificateAuth: true\n hostname: horizon.lab\n tls: true\n\n clientCertificateAuth can be used to control whether to ask for a client certificates when users access Horizon.\n\n If you wish to manually configure your ingress or use another ingress controller, head to the Manual ingress configuration section.\n\n Manual ingress configuration\n\n If you do not wish or cannot use autoconfiguration, you should ensure your ingress controller is correctly configured to enable all Horizon features.\n\n When requiring client certificates for authentication, the web server should not perform checks to validate that the certificate is signed by a trusted CA. Instead, the certificate should be sent to Horizon through a request header, base64-encoded. The header name used can be controlled using the clientCertificateHeader .\n\n Some endpoints should not be server over HTTPS, in particular those used for SCEP enrollment. You may want to create an HTTP-only ingress for serving paths prefixed by /scep and /certsrv , and prevent those from redirecting to HTTPS.\n\n Installation\n Upgrade", - "keywords": [ - "production", - "checklist", - "install-guide", - "install-guide/k8s/production", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.2:install-guide:k8s:uninstall", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Uninstall", - "section": "install-guide", - "slug": "install-guide/k8s/uninstall", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/k8s/uninstall.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/uninstallation.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Uninstall" - ], - "summary": "Uninstall ⚠ Deprecated: This version reached LDOS on 28/09/2024. To uninstall Horizon from your cluster, simply run : $ helm uninstall horizon -n horizon This will uninstall Horizon. If you installed a local MongoDB instance through the Hor", - "content": "Uninstall\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n To uninstall Horizon from your cluster, simply run :\n\n $ helm uninstall horizon -n horizon\n\n This will uninstall Horizon. If you installed a local MongoDB instance through the Horizon’s chart, it will also be uninstalled, meaning you’ll lose all data from the instance.\n\nBefore uninstalling Horizon, if you wish to keep your database, please back up your application secrets (in particular the SSV secret). Without it, you won’t be able to decrypt your database and it will become useless.\n\n Upgrade\n Installing with Docker", - "keywords": [ - "uninstall", - "install-guide", - "install-guide/k8s/uninstall", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.2:install-guide:k8s:upgrade", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Upgrade", - "section": "install-guide", - "slug": "install-guide/k8s/upgrade", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/k8s/upgrade.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/upgrade.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Upgrade" - ], - "summary": "Upgrade ⚠ Deprecated: This version reached LDOS on 28/09/2024. We recommended that you only change values you need to customize in your values.yml file to ensure smooth upgrading. Always check the upgrading instructions between chart versio", - "content": "Upgrade\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n We recommended that you only change values you need to customize in your values.yml file to ensure smooth upgrading.\nAlways check the upgrading instructions between chart versions.\n\n Upgrading the chart\n\n When upgrading Horizon, you’ll need to pull the latest version of the chart:\n\n $ helm repo update evertrust\n\n Verify that you now have the latest version of Horizon (through the App version column):\n\n $ helm search repo evertrust/horizon\nNAME CHART VERSION\tAPP VERSION\tDESCRIPTION\nevertrust/horizon 0.5.3 2.2.2 EverTrust Horizon Helm chart\n\n Launch an upgrade by specifying the new version of the chart through the --version flag in your command :\n\n $ helm upgrade <horizon> evertrust/horizon \\\n --values override-values.yaml \\\n --version 0.5.3\n\n The chart will automatically create a Job that runs an upgrade script when it detects that the Horizon version has changed between two releases. If the upgrade job fails to run, check the job’s pod logs. When upgrading from an old version of Horizon, you may need to explicitly specify the version you’re upgrading from using the upgrade.from key.\n\nBefore upgrading to specific chart version, thoroughly read any Specific chart upgrade instructions for your version.\n\n Specific chart upgrade instructions\n\n Upgrading to 0.3.0\n\n Loggers are now configured with an array instead of a dictionary. Check the values.yaml format and update your override values.yaml accordingly.\n\n The init database parameters ( initDatabase , initUsername and initPassword ) have been renamed and moved to mongodb.horizon .\n\n Upgrading to 0.5.0\n\n The ingress definition has changed. The rules and tls keys have been removed in favor of a more user-friendly hostname that will autoconfigure the ingress rules, and a boolean tls key that will enable TLS on that ingress. Check the Ingress section.\n\n Production checklist\n Uninstall", - "keywords": [ - "upgrade", - "install-guide", - "install-guide/k8s/upgrade", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.2:install-guide:troubleshooting", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Troubleshooting", - "section": "install-guide", - "slug": "install-guide/troubleshooting", - "url": "https://docs.evertrust.fr/horizon/2.2/install-guide/troubleshooting.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/troubleshooting.html", - "breadcrumbs": ["Horizon", "Installation", "Troubleshooting"], - "summary": "Troubleshooting ⚠ Deprecated: This version reached LDOS on 28/09/2024. Horizon Doctor Horizon doctor is a tool that performs checks on your Horizon installation as well as its required dependencies to ensure that everything is configured pr", - "content": "Troubleshooting\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Horizon Doctor\n\n Horizon doctor is a tool that performs checks on your Horizon installation as well as its required dependencies to ensure that everything is configured properly.\nThe tool is targeted towards troubleshooting during installation or update procedures.\nNote that the tool requires root permissions to run.\n\n Performed checks\n\n At the moment, Horizon Doctor checks for:\n\n OS checks\n\n Checks for installed Horizon version, MongoDB version, Java version, Nginx version, OS Version.\n\n If the OS is a RedHat distribution, checks if the RedHat subscription is active.\n\n If Mongo is not installed locally, it notices it as an information log.\n\n Checks for SELinux 's configuration: throws a warning if it is enabled, says ok if it is on permissive or disabled.\n\n Checks for the status of the necessary services: postfix , mongod , nginx and horizon .\n\n If the postfix service is running, tries to connect via a TCP SYN on the port 25 of the relayhost specified in the /etc/postfix/main.cf file and throws an error if it can’t.\n\n Checks how long the Horizon service has been running for.\n\n Checks if there is an NTP service active on the machine and checks if the system clock is synchronized with the NTP service.\n\n Config checks\n\n Checks for existence and permissions of the configuration file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for existence and permissions of the licence file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for existence and permissions of the vault file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for the permission of the Horizon directory (default: /opt/horizon): the permission is expected to be at least 755.\n\n Checks for the existence of the symbolic link for nginx configuration and runs an nginx -t test.\n\n Retrieves the Java heap size parameters that were set for Horizon and throws a warning if the default ones are used (min = 2048 and max = 3072).\n\n Retrieves the Horizon DNS hostname and stores it for a later test (throws an error if it has not been set).\n\n Checks for the Horizon Play Secret and Horizon Event Seal Secret : these are the Horizon application secrets and should be different from default value thus Horizon Doctor throws an error if either of them is equal to the default value ( changeme ).\n\n Retrieves the MongoDB URI (throws a warning if MongoDB is running on localhost; throws an error if MongoDB is running on an external instance but the authSource=admin parameter is missing from the URI).\n\n Parses the Horizon licence file to retrieve its expiration date as well as the licence details (number of holders per category).\n\n Network checks\n\n Runs a MongoDB ping on the URI, then checks for the database used in the URI (throws a warning if the database used is not called horizon ; throws an error if no database is specified in the URI).\n\n Checks for AKKA High Availability settings: if no node hostname is set up, skips the remaining HA checks. If 2 nodes are set up, retrieves which node is running the doctor and checks for the other node. If 3 nodes are set up, retrieves which node is running the doctor and checks for the other 2 nodes.\nThe check runs as:\n\n if curl is installed, runs a curl request on the Node hostname at alive on the management port (default is 8558), and if alive runs another curl request on the Node hostname at /ready on the management port. Both requests should return HTTP/200 if ok, 000 otherwise.\n\n if curl is not installed, uses the built-in Linux TCP socket to run TCP SYN checks on both the HA communication port (default is 25520) and the management port (default is 8558) on the Node hostname.\n\n Checks for firewall configuration . Currently only supports firewalld (RHEL) and a netstat test.\n\n The netstat part will run a netstat command to check if the JVM listening socket is active (listening on port 9000). If netstat is not installed, it will skip this test.\n\n The firewalld part will check if the HTTP and HTTPS services are opened in the firewall and if it detected a HA configuration, it will check if the HA ports (both of them) are allowed through the firewalld. If firewalld is not installed or not active, it will skip this test.\n\n Checks if IPv6 is active in every network interface and throws a warning if it is the case (specifying the interface with IPv6 turned on).\n\n TLS checks\n\n Checks for existence and permissions of the Horizon server certificate file: the permissions are expected to be at least 640 and the file is supposed to belong to the nginx group.\n\n Parses the Horizon server certificate file: it should be constituted of the actual TLS server certificate first, then of every certificate of the trust chain (order being leaf to root). It throws a warning if the certificate is self-signed or raises an error if the trust chain has not been imported. It otherwise tries to reconstitute the certificate trust chain via the openssl verify command, and throws an error if it cannot.\n\n Parses the Horizon server certificate file and checks if the Horizon hostname is present in the SAN DNS names of the certificate, throws an error if it is not there.\n\n Log packing option\n\n If the Horizon doctor is launched with the -l option , it will pack the logs of the last 7 days (in /opt/horizon/var/log ) as well as the startup logs (the /var/log/horizon/horizon.log file) and create a tar archive.\n\n The -l option accepts an optional parameter that should be an integer (1-99) and will pack the logs of the last n days instead, as well as the startup logs.\n\n Note that the Horizon doctor will still perform all of its check; the log packing is done at the very end of the program.\n\n Example of call to pack the logs of the last 7 days:\n\n $ horizon-doctor -l\n\n Example of call to pack the logs of the last 30 days:\n\n $ horizon-doctor -l 30\n\n Saving the doctor’s output\n\n If the Horizon doctor is launched with the -o option , it will perform all of its checks and save the output in the specified file instead of displaying it into the stdout (default is the command line interface).\n\n If you use the option, you must provide a filepath in a writable directory.\n\n Example of call to save the output in a file named horizon-doctor.out instead of the stdout :\n\n $ horizon-doctor -o horizon-doctor.out\n\n Help menu\n\n To display Horizon doctor’s help menu, use the -h option.\n\n Additional checks\n\n Ensure that you are using an up-to-date web browser when trying to access the Horizon web interface\n\n Ensure that Javascript in turned on in your web browser\n\n Ensure that your user machine can access the server where Horizon was installed\n\n If several hostnames have been set up for the Horizon interface, ensure that every single one of them is present in the TLS certificate SAN DNS names\n\n First login\n Introduction", - "keywords": [ - "troubleshooting", - "install-guide", - "install-guide/troubleshooting", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.2:release-notes:2.2.0", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Horizon 2.2.0 release notes", - "section": "release-notes", - "slug": "release-notes/2.2.0", - "url": "https://docs.evertrust.fr/horizon/2.2/release-notes/2.2.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.2/release-notes/2.2.0.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.2.0 release notes" - ], - "summary": "Horizon 2.2.0 release notes ⚠ Deprecated: This version reached LDOS on 28/09/2024. Here are the release notes for EverTrust Horizon v2.2.0, released on 2022-05-06. For the installation and upgrade procedure, please refer to the Installation", - "content": "Horizon 2.2.0 release notes\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Here are the release notes for EverTrust Horizon v2.2.0, released on 2022-05-06.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCE-321] - Adding webhook notifications (Mattermost, Slack, Microsoft Teams)\n\n [HCE-321] - Enhanced certificate’s ownership management by introducing the concept of team\n\n [HCE-333] - Adding the capability to specify labels, team and owner on open protocols ACME, EST, SCEP (Enriched Certificate Profile)\n\n [HCE-337] - Adding the capability to schedule and email CSV report for certificate and request using Horizon Query Language (HCQL & HRQL)\n\n [HCE-339] - Adding support for Microsoft Endpoint Manager (Intune) revocation API (Intune MDM module), in addition to the Legacy revocation mode.\n\n [HCE-322] - Added support for Atos MetaPKI\n\n 2. Enhancements\n\n [HCE-336] - Enhanced support for Microsoft Endpoint Manager (Intune) Imported PKCS mode.\n\n [HCE-323] - Improved caching performance by migrating from EHCache to Caffeine for internal caching\n\n [HCE-324] - Enhanced Web User Interface\n\n [HCE-325] - Optimized license count to overcome performance bottleneck for non Enterprise license\n\n [HCE-326] - Enhanced Horizon APM capabilities\n\n [HCE-327] - Upgraded Play framework along with dependencies to the latest version\n\n [HCE-328] , [HCE-331] , [HCE-332] - Enhanced overall performances by removing cluster singleton bottlenecks on Certificate Authority Manager, Security Manager and PKI Connector Manager\n\n [HCE-330] - Adding the capability to address labels and DN elements in certificate’s and request’s dictionaries (notifications)\n\n [HCE-334] - Adding the capability to disable revocation notification when certificate was already renewed\n\n [HCE-335] - Adding dark mode along with language selection in user preferences\n\n [HCE-338] - Adding more flexibility when configuring third party permissions\n\n [RC-22] - Moved to token authentication for Jamf Pro access\n\n [HG-389] - Improved how roles and teams are managed in authorizations\n\n [HG-406] - Improved dashboard diagrams displaying per-CA analytics\n\n 3. Bug Fixes\n\n [HCE-340] - Fixed a defect regarding third party certificate renewal for third parties not handling certificates' history (F5 BigIP, Intune, Intune PKCS)\n\n [RC-23] - Fixed proxy support for AWS ACM third party connector\n\n [CF-15] - Fixed IP address parsing in SAN\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.2.1 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.2:release-notes:2.2.1", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Horizon 2.2.1 release notes", - "section": "release-notes", - "slug": "release-notes/2.2.1", - "url": "https://docs.evertrust.fr/horizon/2.2/release-notes/2.2.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.2/release-notes/2.2.1.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.2.1 release notes" - ], - "summary": "Horizon 2.2.1 release notes ⚠ Deprecated: This version reached LDOS on 28/09/2024. Here are the release notes for EverTrust Horizon v2.2.1, released on 2022-07-29. For the installation and upgrade procedure, please refer to the Installation", - "content": "Horizon 2.2.1 release notes\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Here are the release notes for EverTrust Horizon v2.2.1, released on 2022-07-29.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HCE-375] - Add support for Sectigo PKI, limited to TLS certificates support\n\n 2. Enhancements\n\n [HCE-381] - Add support for Cipher Groups in F5 BigIP connectors\n\n [CF-17] - Improve support for ADCS by submitting fully custom PKCS#10\n\n [HCE-383] , [HCE-362] - Add new dynamic attributes(SANs, team) in notifications\n\n 3. Bug Fixes\n\n [HG-437] , [HG-452] , [HG-459] - Fix various issues involving Report’s CSV fields and sorted elements\n\n [HG-447] - Fix filling password on profile update or recovery\n\n [HG-456] - Add validation on timeout field for PKI connectors and prevent PKCS#12 issues\n\n [HCE-341] , [HCE-380] - Enhance the actor restart strategy and timeout management\n\n [HCE-347] - Enhance the EST challenge storing\n\n [PC-18] - Fix AWS ACM PCA connector incorrect handling of some SANs\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.2.2 release notes\n Horizon 2.2.0 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.2:release-notes:2.2.2", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Horizon 2.2.2 release notes", - "section": "release-notes", - "slug": "release-notes/2.2.2", - "url": "https://docs.evertrust.fr/horizon/2.2/release-notes/2.2.2.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.2/release-notes/2.2.2.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.2.2 release notes" - ], - "summary": "Horizon 2.2.2 release notes ⚠ Deprecated: This version reached LDOS on 28/09/2024. Here are the release notes for EverTrust Horizon v2.2.2, released on 2022-08-12. For the installation and upgrade procedure, please refer to the Installation", - "content": "Horizon 2.2.2 release notes\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Here are the release notes for EverTrust Horizon v2.2.2, released on 2022-08-12.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HCE-388] - Enhanced the trust chain API to support full trust chain in EverTrust cert-manager issuer (Kubernetes / OpenShift)\n\n 3. Bug Fixes\n\n [HCA-387] - Fixed support of certificate based authentication when using Traefik ingress (Kubernetes / OpenShift)\n\n [HCA-389] - Fixed a defect where PLAY_SESSION cookie never expires\n\n [HCA-390] - Upgraded dependencies with known vulnerabilities (Play Framework 2.8.15 → 2.8.16)\n\n 4. Known Defects\n\n [None]\n\n Searching requests and certificates\n Horizon 2.2.1 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.2:user-guide:est", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "How to Request an EST challenge", - "section": "user-guide", - "slug": "user-guide/est", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/est.html", - "breadcrumbs": ["Horizon", "User guide", "Requesting an EST challenge"], - "summary": "How to Request an EST challenge ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how you can get an EST Challenge. 1. Log in to Horizon Registration Authority Interface 2. Access My requests from the drawer: 3. Cl", - "content": "How to Request an EST challenge\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how you can get an EST Challenge.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access My requests from the drawer:\n\n 3. Click on add button\n\n 4. Select Request EST Challenge\n\n You must have the permission to request an EST challenge on at least one EST profile.\n\n Profile tab\n\n 1. Select the EST profile.\n\n 2. Click on next button.\n\n Metadata tab\n\n 1. Fill in all the mandatory fields:\n\n Labels(string):\n\nThe labels are used for permission, email and request search.\n\n Contact email address(string email format):\n\nUsed if an email notification is set. An email can be sent each time the request status changes (see request lifecycle ).\n\n Requester comment(string):\n\nThis comment appears:\n\n to the approver when your request is in the pending status\n\n in the certificate information after the enrollment\n\n 2. Click on next button\n\n Summary\n\n If you own the enrolling permission on the EST profile:\n\n 1. Click on the Retrieve challenge button\n\n If you own the \"request\" permission on the EST profile:\n\n 1. Click on request button\n\n You have to wait that your request is approved by an operator and its status is 'completed', in order to use your EST challenge\n\n 2. click on View Request\n\n You now have access to your EST challenge\n\n You can cancel your request at any time, as long as the request status is pending, by clicking on\n\n How to enroll using EST\n\n This section details how to enroll using the Horizon Client ( horizon-cli ). It is also possible to use another EST client implementation, as long as it complies with RFC 7030.\n\n Prerequisites\n\n You need the horizon-cli tools\n\n Enroll with Horizon Client\n\n 1. Set the horizon root endpoint\n\n export ``ENDPOINT``=https://<horizon_url>\n\n The endpoint can instead be set in horizon-cli configuration file\n\n 2. Enroll with horizon-cli\n\n horizon-cli est --enroll <your_challenge> --profile <est_profile> --key <link_to_the_privatekey> --cn <certificate_cn> --cert <name_of_the_output_certificate>\n\n If the enrollment succeeds, the challenge is no longer usable, as it is a one-time password.\n\n Requesting a SCEP challenge\n Managing requests (operator)", - "keywords": [ - "how", - "to", - "request", - "an", - "est", - "challenge", - "user-guide", - "user-guide/est", - "horizon", - "user", - "guide", - "requesting" - ] - }, - { - "page_id": "horizon:2.2:user-guide:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Introduction", - "section": "user-guide", - "slug": "user-guide/introduction", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/introduction.html", - "breadcrumbs": ["Horizon", "User guide", "Introduction"], - "summary": "Introduction ⚠ Deprecated: This version reached LDOS on 28/09/2024. Description Horizon is an EverTrust Certificate lifecycle management solution and is powered up by: Akka BouncyCastle MongoDB Kamon Play! Framework Scala NGINX Vue.js Quasa", - "content": "Introduction\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Description\n\n Horizon is an EverTrust Certificate lifecycle management solution and is powered up by:\n\n Akka\n\n BouncyCastle\n\n MongoDB\n\n Kamon\n\n Play! Framework\n\n Scala\n\n NGINX\n\n Vue.js\n\n Quasar\n\n This document is specific to Horizon version 2.2 .\n\n Reports\n Managing requests on the WebRA", - "keywords": [ - "introduction", - "user-guide", - "user-guide/introduction", - "horizon", - "user", - "guide" - ] - }, - { - "page_id": "horizon:2.2:user-guide:manage_requests", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Operator", - "section": "user-guide", - "slug": "user-guide/manage_requests", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/manage_requests.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/manage_requests.html", - "breadcrumbs": ["Horizon", "User guide", "Managing requests (operator)"], - "summary": "Operator ⚠ Deprecated: This version reached LDOS on 28/09/2024. An Operator is someone who owns the permission to approve or deny a request. Manage Request This section details how to manage a request (view, approve, deny). 1. Log in to Hor", - "content": "Operator\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n An Operator is someone who owns the permission to approve or deny a request.\n\n Manage Request\n\n This section details how to manage a request (view, approve, deny).\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access Manages requests from the drawer: Manage requests\n\n How to view a request\n\n 3. Click on view request button\n\n 4. Check all the information from the request\n\n 5. At the end you can either approve or deny the request\n\n How to approve a request\n\n 3. Click on approve request button and approve the request\n\n If the certificate has mandatory metadata you will need to fill it in before approving the request, otherwise you will get an error.\n\n How to deny a request\n\n 3. Click on deny request button and deny the request\n\n Requesting an EST challenge\n Searching requests and certificates", - "keywords": [ - "operator", - "user-guide", - "user-guide/manage_requests", - "horizon", - "user", - "guide", - "managing", - "requests" - ] - }, - { - "page_id": "horizon:2.2:user-guide:scep", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "How to Request a SCEP challenge", - "section": "user-guide", - "slug": "user-guide/scep", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/scep.html", - "breadcrumbs": ["Horizon", "User guide", "Requesting a SCEP challenge"], - "summary": "How to Request a SCEP challenge ⚠ Deprecated: This version reached LDOS on 28/09/2024. This section details how you can get a SCEP Challenge. 1. Log in to Horizon Registration Authority Interface 2. Access My requests from the drawer: 3. Cl", - "content": "How to Request a SCEP challenge\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n This section details how you can get a SCEP Challenge.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access My requests from the drawer:\n\n 3. Click on add button\n\n 4. Select Request SCEP Challenge\n\n You must have the permission to request a SCEP challenge on at least one SCEP profile.\n\n Profile tab\n\n 1. Select the SCEP profile\n\n 2. Click on next button\n\n Metadata tab\n\n 1. Fill in all the mandatory fields:\n\n Labels(string):\n\nThe labels are used for permission, email and request search.\n\n Contact email address(string email format):\n\nUsed if an email configuration is set. An email can be sent each time the request status changes (see request lifecycle ).\n\n Requester comment(string):\n\nThis comment appears:\n\n to the approver when your request is in the pending status\n\n in the certificate information after the enrollment\n\n 2. Click on next button\n\n Summary\n\n If you own the enrolling permission on the SCEP profile:\n\n 1. Click on the Retrieve challenge button\n\n If you own the request permission on the SCEP profile:\n\n 1. Click on request button\n\n You have to wait that your request is approved by an operator and its status is 'completed', in order to use your SCEP challenge\n\n 2. click on View Request\n\n You now have access to your SCEP challenge\n\n In order to enroll using SCEP you will need at least a challenge and the SCEP endpoint:\n\n https://<horizon_url>/scep/<profile>/pkiclient.exe\n\n In case you use the NDES emulation, the enrollment and challenge URLs will be respectively:\n- https://<horizon_url>/certsrv/<profile>/mscep\n- https://<horizon_url>/certsrv/<profile>/mscep_admin\n\n You can cancel your request at any time, as long as the request status is pending, by clicking on\n\n How to request a certificate recovery\n Requesting an EST challenge", - "keywords": [ - "how", - "to", - "request", - "scep", - "challenge", - "user-guide", - "user-guide/scep", - "horizon", - "user", - "guide", - "requesting" - ] - }, - { - "page_id": "horizon:2.2:user-guide:search", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Searching requests and certificates", - "section": "user-guide", - "slug": "user-guide/search", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/search.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/search.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Searching requests and certificates" - ], - "summary": "⚠ Deprecated: This version reached LDOS on 28/09/2024. Search Request Here is the section where you can search easily find all information regarding the request. How to do a simple request search 1. Log in to Horizon Registration Authority ", - "content": "⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificate or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificate or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.2.2 release notes", - "keywords": [ - "searching", - "requests", - "and", - "certificates", - "user-guide", - "user-guide/search", - "horizon", - "user", - "guide" - ] - }, - { - "page_id": "horizon:2.2:user-guide:webra:enroll", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "How to enroll a certificate using the WebRA", - "section": "user-guide", - "slug": "user-guide/webra/enroll", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/webra/enroll.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/enroll.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to enroll a certificate using the WebRA" - ], - "summary": "How to enroll a certificate using the WebRA ⚠ Deprecated: This version reached LDOS on 28/09/2024. 1. Log in to Horizon registration authority Interface 2. Access Request Certificate from the drawer: Request Certificate Profile tab 3. Fill ", - "content": "How to enroll a certificate using the WebRA\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n 1. Log in to Horizon registration authority Interface\n\n 2. Access Request Certificate from the drawer: Request Certificate\n\n Profile tab\n\n 3. Fill in all the mandatory fields\n\n Certificate profile * (string select) :\n\nThe certificate profile will be used in order to build the next step of the enrollment.\n\n If the decentralized enrollment is activated for the profile:\n\n Either:\n\n CSR * (string) :\n\nThe CSR in PEM format\n\n Import a CSR file * (file) :\n\nThe CSR file\n\n If the centralized enrollment is activated for the profile:\n\n Key type * (string select) :\n\nThe key type will be used for the private key generation\n\n In case of the definition of a password policy:\n\n Password * (string) :\n\nThe password will be used for the PKCS#12 encryption\n\n You must comply with the configured password policy.\n\n 4. Click on Next button.\n\n Data tab\n\n 5. Fill in all the mandatory fields:\n\n Subject * (string) :\n\nSubject fields will be for the certificate\n\n Subject Alternatives Names * (string) :\n\nSubject Alternative Names will be for the certificate\n\n In decentralized mode, CSR values will be used as default for the corresponding fields.\n\n You must comply with the configured regular expression(s) that you can get with the ? icon.\n\n 6. Click on next button.\n\n Metadata tab\n\n 7. Fill in all the mandatory fields:\n\n Labels * (string) :\n\nThe labels will be used for permission, email and certificate search.\n\n You must comply with the configured regular expression(s) that you can get with the ? icon.\n\n Contact email address (string email format) :\n\nUsed if an email configuration is set. An email can be sent each time the request status changes (see request lifecycle ).\n\n Requester comment (string) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n 8. Click on next button.\n\n Summary tab\n\n If you own the enrolling permission\n\n 9. Click on enroll button\n\nYou can download the PKCS#12 after the enrollment if you are allowed to in the profile\n\n If you own the request certificate permission\n\n 9. Click on request button\n\nYou have to wait until your request is approved, afterward you will be able to download the PKCS#12 if you are allowed to in the profile\n\n Managing requests on the WebRA\n How to request a certificate revocation", - "keywords": [ - "how", - "to", - "enroll", - "certificate", - "using", - "the", - "webra", - "user-guide", - "user-guide/webra/enroll", - "horizon", - "user", - "guide", - "managing", - "requests", - "on" - ] - }, - { - "page_id": "horizon:2.2:user-guide:webra:recover", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "How to request a certificate recovery", - "section": "user-guide", - "slug": "user-guide/webra/recover", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/webra/recover.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/recover.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate recovery" - ], - "summary": "How to request a certificate recovery ⚠ Deprecated: This version reached LDOS on 28/09/2024. 1. Log in to Horizon Registration Authority Interface 2. Access request recover from the drawer: My certificate or Search certificates 3. Click on ", - "content": "How to request a certificate recovery\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request recover from the drawer: My certificate or Search certificates\n\n 3. Click on request recover button\n\n Recover Options tab\n\n 4. Fill in the information you want to add.\n\n Contact_Email (string email format) :\n\nUsed if an email configuration is set. An email can be sent every time the request status change (see request lifecycle ).\n\n Recover comment (string regex) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n Certificate tab\n\n 5. You can also check the certificate information\n\n Details tab\n\n 6. You can also check the certificate information\n\n 7. Once you have checked and added the information you wanted you can request the recover by clicking on the recover button\n\n 8. You will be able to see and copy the password and download the certificate PKCS#12\n\n How to request a certificate renewal\n Requesting a SCEP challenge", - "keywords": [ - "how", - "to", - "request", - "certificate", - "recovery", - "user-guide", - "user-guide/webra/recover", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.2:user-guide:webra:renew", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "How to request a certificate renewal", - "section": "user-guide", - "slug": "user-guide/webra/renew", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/webra/renew.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/renew.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate renewal" - ], - "summary": "How to request a certificate renewal ⚠ Deprecated: This version reached LDOS on 28/09/2024. 1. Log in to Horizon Registration Authority Interface 2. Access request renew from the drawer: My certificate or Search certificates 3. Click on req", - "content": "How to request a certificate renewal\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request renew from the drawer: My certificate or Search certificates\n\n 3. Click on request renew button\n\n Profile tab\n\n 4. Fill in all the mandatory fields\n\n Key type * (string) :\n\nThe key type will be used for the private key generation\n\n In case of the definition of a password policy:\n\n Password * (string) :\n\nThe password will be used for the PKCS#12 encryption\n\n 5. Go to enroll (same as renew) and follow all the steps\n\n How to request a certificate update\n How to request a certificate recovery", - "keywords": [ - "how", - "to", - "request", - "certificate", - "renewal", - "user-guide", - "user-guide/webra/renew", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.2:user-guide:webra:revoke", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "How to request a certificate revocation", - "section": "user-guide", - "slug": "user-guide/webra/revoke", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/webra/revoke.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/revoke.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate revocation" - ], - "summary": "How to request a certificate revocation ⚠ Deprecated: This version reached LDOS on 28/09/2024. 1. Log in to Horizon registration authority Interface 2. Access Either my certificates or Search certificates from the drawer: My Certificates / ", - "content": "How to request a certificate revocation\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n 1. Log in to Horizon registration authority Interface\n\n 2. Access Either my certificates or Search certificates from the drawer: My Certificates / Search Certificates\n\n 3. Click on the Revoke icon:\n\n The revoke icon appears only if you own the permission to revoke the certificate\n\n Revocation Options tab\n\n 4. Fill in all the mandatory fields.\n\n Revocation reason * (String select) :\n\nThe revocation reason that will appear on the CRL\n\n Contact email address (string email format) :\n\nUsed if an email configuration is set. An email can be sent each time the request status changes (see request lifecycle )\n\n Requester comment (String) :\n\nThis comment appears:\n\n by the approver when your request is in the pending status\n\n to the certificate info after the revocation\n\n 5. Click on Certificate tab\n\n Certificate tab\n\n 6. Check the certificate’s information\n\n 7. Click on Details tab\n\n Details tab\n\n 8. Check the certificate’s details\n\n If you have the enrolling permission\n\n 9. Click on the enroll button\n\nYou can download the PKCS#12 after the enrollment if you are allowed to in the profile\n\n If you own the request certificate permission\n\n 9. Click on request button\n\nYou have to wait until your request is approved, afterward you will be able to download the PKCS#12 if you are allowed to in the profile\n\n How to enroll a certificate using the WebRA\n How to request a certificate update", - "keywords": [ - "how", - "to", - "request", - "certificate", - "revocation", - "user-guide", - "user-guide/webra/revoke", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.2:user-guide:webra:update", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "How to request a certificate update", - "section": "user-guide", - "slug": "user-guide/webra/update", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/webra/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/update.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate update" - ], - "summary": "How to request a certificate update ⚠ Deprecated: This version reached LDOS on 28/09/2024. 1. Log in to Horizon Registration Authority Interface 2. Access request update from the drawer: My certificate or Search certificates 3. Click on req", - "content": "How to request a certificate update\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request update from the drawer: My certificate or Search certificates\n\n 3. Click on request update button\n\n Details tab\n\n 4. You can update in the metadata section the fields contact_email and labels (if labels are mandatory)\n\n Label (string regex) :\n\nEnter a correct label\n\n Contact_Email (string email format) :\n\nUsed if an email configuration is set. An email can be sent each time the request status change (see request lifecycle ).\n\n 5. You can also check the details information\n\n Certificate tab\n\n 6. You can also check the certificate information\n\n 7. Once you have made changes you can request the update by clicking on the update button\n\n How to request a certificate revocation\n How to request a certificate renewal", - "keywords": [ - "how", - "to", - "request", - "certificate", - "update", - "user-guide", - "user-guide/webra/update", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.2:user-guide:webra:workflow", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.2", - "title": "Requester", - "section": "user-guide", - "slug": "user-guide/webra/workflow", - "url": "https://docs.evertrust.fr/horizon/2.2/user-guide/webra/workflow.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/workflow.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA" - ], - "summary": "Requester ⚠ Deprecated: This version reached LDOS on 28/09/2024. By definition, a requester is someone who is granted the permission to request a certificate (enroll, renew, revoke, update, recover). Each Request has the same lifecycle desc", - "content": "Requester\n\n ⚠  Deprecated: This version reached LDOS on 28/09/2024.\n\n By definition, a requester is someone who is granted the permission to request a certificate (enroll, renew, revoke, update, recover).\n\n Each Request has the same lifecycle described by the following figure.\n\n Figure 1. Request Workflow\n\n Introduction\n How to enroll a certificate using the WebRA", - "keywords": [ - "requester", - "user-guide", - "user-guide/webra/workflow", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:ca", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Certification Authorities", - "section": "admin-guide", - "slug": "admin-guide/ca", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/ca.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/ca.html", - "breadcrumbs": ["Horizon", "Admin guide", "Certification Authorities"], - "summary": "Certification Authorities ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure the Certification Authorities known by EverTrust Horizon. Prerequisites Certification Authorities will be needed beforeha", - "content": "Certification Authorities\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure the Certification Authorities known by EverTrust Horizon.\n\n Prerequisites\n\n Certification Authorities will be needed beforehand, in one of these formats:\n\n Certificate file (PEM or DER).\n\n Certificate string (PEM).\n\n You might also need the URL of the CRL issued by the CA, and/or the URL of the OCSP Responder for that CA.\n\n How to configure a Certification Authority\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Certification Authorities from the drawer or card: Certification Authorities .\n\n 3. Click on .\n\n Certificate Tab:\n\n 4. Either\n\n Fill in the certificate section with certificate string (PEM) OR\n\n Import the certificate file (PEM or DER).\n\n Then click on the next button.\n\n Details Tab:\n\n 5. Check the information from your CA certificate. Then click on the next button.\n\n Configuration Tab:\n\n 6. Fill in the information you want to add.\n\n Name * (string input) :\n\nEnter a meaningful certificate authority name. It must be unique for each certificate authority.\n\n OCSP responder URL (string) :\n\nURL to request an OCSP responder.\n\n CRL URL (string) :\n\nURL to download the CA CRL.\n\n Refresh Period ( finite duration ) :\n\nCRL or OCSP Refresh Period. Must be a valid finite duration.\n\n Timeout ( finite duration ) :\n\nConnection timeout when reaching CRL or OCSP. Must be a valid finite duration.\n\n Proxy (option) :\n\nThe HTTP/HTTPS proxy to use to reach the CRL or the OCSP Responder, if any.\n\n Is trusted for server authentication (boolean) :\n\nTells whether the CA should be trusted for server authentication, aka SSL/TLS server trust. The default value is set to false.\n\n Is trusted for client authentication (boolean) :\n\nTells whether the CA should be trusted for client authentication. The default value is set to false.\n\n Outdated Revocation Status Policy (option) :\n\nSelect \"Revoked\" if you want all certificates to be handled as revoked if the CRL/OCSP are unavailable. Select \"Last available status\" if you want Horizon to use the last available revocation status for the certificates.\n\n 7. Click on the import button.\n\n You can edit , download or delete the Certification Authorities.\n\n You will not be able to delete a Certification Authority if it is referenced in any other configuration element.\nPay also attention that the CA might be used (e.g. for TLS trust chain building), even if it is not explicitly referenced in configuration items.\n\n User Information\n PKI Queue", - "keywords": [ - "certification", - "authorities", - "admin-guide", - "admin-guide/ca", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:aws", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "AWS PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/aws", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/aws.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/aws.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "AWS" - ], - "summary": "AWS PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites You need to create a user using AWS IAM, and give it the AWSCertificateManagerPrivateCAUser right. You need to retrieve the Private CA ARN from ACM Private CA cons", - "content": "AWS PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n You need to create a user using AWS IAM, and give it the AWSCertificateManagerPrivateCAUser right.\n\n You need to retrieve the Private CA ARN from ACM Private CA console.\n\n Refer to the editor’s documentation to configure the PKI side here .\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n AWS Region * (string input) :\n\nAWS region to use.\n\n AWS PCA ARN * (string input) :\n\nAmazon Resource Name (ARN) is a file naming convention used to identify a particular resource in AWS public cloud. To be retrieved from AWS ACM Console.\n\n AWS PCA Template ARN (string input) :\n\nA template is a declaration of the AWS resources that make up a stack. The default value is set to: arn:aws:acm-pca:::template/EndEntityCertificate/V1 .\n\n AWS PCA Role ARN (string input)\n\n Certificate Policy OID (string input) :\n\nAn identifying number, in the form of an \"object identifier\" that is included in the certificatePolicies field of a certificate.\n\n Certificate signing hash (string multiple) :\n\nSelect the hash function that will be used.\n\n Certificate Usage (string multiple) :\n\nSelect the certificate usage.\n\n Number of valid days ( finite duration ) :\n\nCertificate validity duration in days. Must be in valid finite duration.\nThe default value is set to 365 days.\n\n Retry Interval ( finite duration ) :\n\nPredefined interval of time before retrying to retrieve the certificate from AWS. Must be in valid finite duration.\nThe default value is set to 3 seconds.\n\n 9. Click on the next button\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n AWS user access key ID (string input) :\n\nFind AWS Account and Access Keys.\n\n AWS user secret key (string input) :\n\nMust be set only if and only if AWS user access key ID is set.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the AWS PKI connector.\n\n General Information\n CertEurope", - "keywords": [ - "aws", - "pki", - "admin-guide", - "admin-guide/connectors/aws", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:certeurope", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "CertEurope PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/certeurope", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/certeurope.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/certeurope.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "CertEurope" - ], - "summary": "CertEurope PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites A technical account should be created. This technical account must have permissions to enroll and revoke SSL certificates on the desired domain(s). Limitati", - "content": "CertEurope PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n A technical account should be created.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired domain(s).\n\n Limitations\n\n Only the following fields are managed: commonName and subjectAltName DNS .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in CCS for the given \"Offer Identifier\", the exceeding items will be ignored.\n\n All limitations induced by the use of the CCS REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Endpoint URL to the CSS partner API * (string input) :\n\nURL to access the CertEurope web service API.\n\n Technical account login * (string input) :\n\nLogin of the technical account created in CCS, usually an email address.\n\n Technical account password * (string input) :\n\nPassword of the technical account created in CCS.\n\n CCS offer identifier * (string input) :\n\nThe identifier of the offer within CCS.\n\n Organization ID * (string input) :\n\nCustomer organization ID. For French companies, it’s usually the \"SIREN\".\n\n Revocation reason (string select) :\n\nSelect from the drop down the default revocation reason.\n\n Interval before retrying to retrieve certificate ( finite duration ) :\n\nThe default value is set to 21 seconds.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import) :\n\nPKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the CertEurope PKI connector.\n\n AWS\n CS-Novidy’s TrustKey", - "keywords": [ - "certeurope", - "pki", - "admin-guide", - "admin-guide/connectors/certeurope", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:csnovidy", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "CS-Novidy’s TrustyKey PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/csnovidy", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/csnovidy.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/csnovidy.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "CS-Novidy’s TrustKey" - ], - "summary": "CS-Novidy’s TrustyKey PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites A technical account should be created. This technical account must have permissions to enroll and revoke SSL certificates on the desired certific", - "content": "CS-Novidy’s TrustyKey PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n A technical account should be created.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired certificate profiles.\n\n An authentication and a signature certificate must be issued under as PKCS#12 files for this account.\n\n Limitations\n\n Only the following fields are managed: commonName (as mail_lastname), contactEmail (as mail_email), OU (as org_unit), O (as corp_company), C (as country), UID (as employeeID), subjectAltNames DNS and msUPN .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in TrustyKey for the given PGC , the exceeding items will be ignored.\n\n All limitations induced by the use of the TrustyKey CMP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n API endpoint URL * (string input) :\n\nURL to access the CS-Novidy’s TrustyKey web service.\n\n PGC * (string input) :\n\nEnter name of the PGC to be used.\n\n TrustyKey PKI server DN * (string input) :\n\nEnter the DN of the TrustyKey PKI server, starting from the CN.\n\n TrustyKey PKI server Certificate * (string input) :\n\nEnter the PEM representing the certificate of the CA issuing the certificates.\n\n CN mapping (string input) :\n\nEnter a CN to be mapped.\n\n Email mapping (string input) :\nEnter an email address or domain to be mapped.\n\n SAN DNS mapping (string input) :\n\nEnter a SAN DNS to be mapped.\n\n Profile mapping (string input) :\n\nEnter a profile to be mapped.\n\n Issuer mapping (string input) :\n\nEnter an issuer to be mapped.\n\n Legacy CMP Style (boolean)\n\nChose whether to use the legacy CMP style.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n Signer PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the signature certificate used to sign the CMP messages.\n\n Signer certificate password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the CS-Novidy’s TrustyKey PKI connector.\n\n CertEurope\n Digicert CertCentral", - "keywords": [ - "cs-novidy", - "trustykey", - "pki", - "admin-guide", - "admin-guide/connectors/csnovidy", - "horizon", - "admin", - "guide", - "pkis", - "connectors", - "trustkey" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:digicert", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "DigiCert CertCentral PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/digicert", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/digicert.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/digicert.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Digicert CertCentral" - ], - "summary": "DigiCert CertCentral PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites You need to validate the domain(s) for which you will issue certificates prior to their issuance. This can be done in DigiCert CertCentral in the ", - "content": "DigiCert CertCentral PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n You need to validate the domain(s) for which you will issue certificates prior to their issuance. This can be done in DigiCert CertCentral in the Certificates > Domains menu.\n\n You need to retrieve the organizationId from DigiCert CertCentral in the Certificates > Organizations menu.\n\n You need to generate an API Key in DigiCert CertCentral using the Account > Account Access menu.\n\n Limitations\n\n Only the following fields are managed: commonName and subjectAltName DNS and RFC822Name .\n\n For multi-valued fields (SAN DNS and RFC822Name ), if more data items are provided than configured in DigiCert CertCentral for the given type of certificate, the exceeding items will be ignored.\n\n All limitations induced by the use of the DigiCert CertCentral REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n DigiCert CertCentral API endpoint * (string input or select) :\n\nURL to access DigiCert CertCentral API along with the certificate type to issue. To do so you can select from the drop down menu or type in your \"certificate offer\" value, then press \"Enter\" the corresponding URL will be automatically fetched.\n\n DigiCert CertCentral Customer Organization ID * (int) :\n\nEnter customer organization ID.\n\n DigiCert CertCentral CA Cert ID (int) :\n\nEnter CA Cert ID, to be used for private CA only.\n\n Interval before retrying to retrieve certificate ( finite duration ) :\n\nUse for private CA only.\nThe default value is set to 9 seconds.\n\n Skip Approval (boolean) :\n\nThe default value is set to false.\n\n 9. Click on the next button.\n\n Custom tab\n\n 10. Click on if custom data mapping is needed.\n\n 11. Fill in the PKI-custom data mapping:\n\n Custom data field * (string input) :\n\n Label field * (select) :\n\nAny existing Horizon Label\n\n 12. Click on the next button.\n\n Authentication tab\n\n 13. Fill in the PKI-authentication fields:\n\n DigiCert CertCentral API Key * (string input) :\n\nEnter the API Key.\n\n 14. Click on the save button.\n\n You can edit , duplicate or delete the DigiCert CertCentral PKI connector.\n\n CS-Novidy’s TrustKey\n EJBCA", - "keywords": [ - "digicert", - "certcentral", - "pki", - "admin-guide", - "admin-guide/connectors/digicert", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:ejbca", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "EJBCA PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/ejbca", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/ejbca.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/ejbca.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "EJBCA" - ], - "summary": "EJBCA PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites A certificate profile should be created, e.g. reusing the default \"SERVER\" certificate profile. An authentication certificate should be issued for Horizon, and i", - "content": "EJBCA PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n A certificate profile should be created, e.g. reusing the default \"SERVER\" certificate profile.\n\n An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned certificate procedure.\n\n Limitations\n\n Only the following fields are managed: all Subject DN fields and subjectAltNames DNS, IPaddress, RFC822Name, msUPN and msGUID .\n\n For multi-valued fields (SAN DNS and RFC822Name ), if more data items are provided than configured in EJBCA for the given End Entity profile, the exceeding items will be ignored.\n\n All limitations induced by the use of the EJBCA RA SOAP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n EJBCA RA URL * (string input) :\n\nEnter SOAP endpoint URL of the EJBCA WebService.\n\n EJBCA Certificate Profile Name * (string input) :\n\nEnter EJBCA Certificate Profile to map for certificate issuance.\n\n EJBCA CA Name * (string input) :\n\nEnter CA to use for certificate issuance.\n\n EJBCA End Entity Profile * (string input) :\n\nEnter EJBCA End Entity profile.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the EJBCA PKI connector.\n\n Digicert CertCentral\n Entrust Certificates Services", - "keywords": [ - "ejbca", - "pki", - "admin-guide", - "admin-guide/connectors/ejbca", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:entrust", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Entrust Certificate Services PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/entrust", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/entrust.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/entrust.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Entrust Certificates Services" - ], - "summary": "Entrust Certificate Services PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites A technical account should be created to be used with the API. This technical account must have permissions to enroll and revoke SSL certi", - "content": "Entrust Certificate Services PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n A technical account should be created to be used with the API.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired certificate profiles (superadmin role).\n\n Limitations\n\n Only the following fields are managed: commonName (as cn, for SMIME certs), contactEmail (as requester email address), OU (only one) and subjectAltName DNS (for SSL certs) and RFC822Name (for SMIME) .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in ECS for the given certificate type, the exceeding items will be ignored.\n\n All limitations induced by the use of the ECS REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Technical account API login * (string input) :\n\nEnter the login of the technical account API.\n\n Technical account API password * (string input) :\n\nEnter the password of the technical account API.\n\n Certificate Type (select) :\n\nSelect the Certificate Type to issue.\n\n Requester’s default email * (string input) :\n\nEnter the requester default email address.\n\n Requester’s name (string input) :\n\nEnter the requester name to register.\n\n Requester’s phone (string input) :\n\nEnter the requester phone to register.\n\n Certificate lifetime ( finite duration ) :\nEnter Certificate lifetime, in days. For SMIME_ENT it is the number of years.\nThe default value is set to 90 days.\n\n Client ID (int) :\n\nEnter Client ID.\nThe default value is set to 1.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Entrust Certificate Services PKI connector.\n\n EJBCA\n EverTrust Integrated CA", - "keywords": [ - "entrust", - "certificate", - "services", - "pki", - "admin-guide", - "admin-guide/connectors/entrust", - "horizon", - "admin", - "guide", - "pkis", - "connectors", - "certificates" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:fisid", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "FISId PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/fisid", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/fisid.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/fisid.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "FISId" - ], - "summary": "FISId PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI > PKI Connectors . 3. Click on . 4. Select the correct PK", - "content": "FISId PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n FISId endpoint URL * (string input) :\n\nURL to access the API.\n\n Template ID * (int) :\n\nEnter the template ID.\n\n Default owner ID * (string input) :\n\nEnter a default owner ID.\n\n Authentication domain ID * (int) :\n\nEnter an authentication domain ID.\n\n Owner groups (string input) :\n\nEnter one or several, separated by commas\n\n To delete after revocation (boolean) :\n\nThe default value is set to false.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n API Key * (string input) :\n\nEnter app key.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the FISId PKI connector.\n\n EverTrust Stream CA\n GlobalSign Atlas", - "keywords": [ - "fisid", - "pki", - "admin-guide", - "admin-guide/connectors/fisid", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:globalsign_atlas", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "GlobalSign Atlas PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/globalsign_atlas", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/globalsign_atlas.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/globalsign_atlas.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "GlobalSign Atlas" - ], - "summary": "GlobalSign Atlas PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI > PKI Connectors . 3. Click on . 4. Select the", - "content": "GlobalSign Atlas PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Hash Algorithm (select) :\n\nSelect the hash algorithm for the certificate to be issue.\n\n API Key * (string input) :\n\nEnter the key that allows to authenticate against GlobalSign Atlas API.\n\n API Secret * (string input) :\n\nEnter the password used to secure the aforementioned API Key.\n\n Certificate Usage (select) :\n\nSelect a usage from the drop down list.\n\n Retry Interval ( finite duration ) :\n\nThe default value is set to 3 seconds.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 10. Click on the save button.\n\n You can edit , duplicate or delete the GlobalSign Atlas PKI connector.\n\n FISId\n GlobalSign MSSL", - "keywords": [ - "globalsign", - "atlas", - "pki", - "admin-guide", - "admin-guide/connectors/globalsign_atlas", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:globalsign_mssl", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "GlobalSign MSSL PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/globalsign_mssl", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/globalsign_mssl.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/globalsign_mssl.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "GlobalSign MSSL" - ], - "summary": "GlobalSign MSSL PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites A technical account should be created. This technical account must have permissions to enroll and revoke SSL certificates on the desired domain. Limita", - "content": "GlobalSign MSSL PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n A technical account should be created.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired domain.\n\n Limitations\n\n Only the following fields are managed: contactEmail and subjectAltName DNS .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in GlobalSign MSSL for the given \"Product\", the exceeding items will be ignored.\n\n All limitations induced by the use of the GlobalSign MSSL SOAP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n GlobalSign endpoint * (string select) :\n\nSelect from the drop-down list: the value must be \"prod\" for GlobalSign Production endpoint or \"test\" for the test environment.\n\n GlobalSign profile ID * (string input) :\n\nTo be retrieved from the URL in the GlobalSign MSSL console.\n\n GlobalSign domain ID * (string input) :\n\nThe ID of the domain to manage. Displayed in the GlobalSign MSSL console.\n\n Certificate validity (int input) :\n\nCertificate validity in months.\n\n Default email address (string input) :\n\nChoose a default email address.\n\n Default phone number (string input) :\n\nChoose a default phone number.\n\n Interval before retrying to retrieve certificate ( finite duration ) :\n\nThe default value is set to 9 seconds.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Technical account username * (string input) :\n\nUsername of the technical account created in GlobalSign MSSL.\n\n Technical account password * (string input) :\n\nPassword of the technical account created in GlobalSign MSSL.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the GlobalSign MSSL PKI connector.\n\n GlobalSign Atlas\n MetaPKI", - "keywords": [ - "globalsign", - "mssl", - "pki", - "admin-guide", - "admin-guide/connectors/globalsign_mssl", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:integrated", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "EverTrust integrated CA", - "section": "admin-guide", - "slug": "admin-guide/connectors/integrated", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/integrated.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/integrated.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "EverTrust Integrated CA" - ], - "summary": "EverTrust integrated CA ⚠ Deprecated: This version reached LDOS on 16/05/2025. Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI > PKI Connectors . 3. Click on . 4. Select ", - "content": "EverTrust integrated CA\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Certificate Type * (select) :\n\nSpecify the certificate type to issue.\n\n Signing algorithm * (select) :\n\nSpecify the signing algorithm.\n\n CA Certificate (string input) :\n\nEnter CA certificate.\n\n CA Key (string input) :\n\nEnter CA key.\n\n CRL save path (string input) :\n\nPath to save the CRL on the Horizon server.\n\n CRL lifetime ( finite duration ) :\n\nCRL lifetime in days. Must be a valid finite duration.\n\n Certificate Back Date ( finite duration ) :\n\nCertificate Back Date. Must be a valid duration.\n\n Check Proof of Possession (boolean)\n\n 9. Click on the save button.\n\n You can edit , duplicate or delete the EverTrust integrated CA PKI connector.\n\n Entrust Certificates Services\n EverTrust Stream CA", - "keywords": [ - "evertrust", - "integrated", - "ca", - "admin-guide", - "admin-guide/connectors/integrated", - "horizon", - "admin", - "guide", - "pkis", - "pki", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:metapki", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "MetaPKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/metapki", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/metapki.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/metapki.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "MetaPKI" - ], - "summary": "MetaPKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites Endpoint issuing CA Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI > PKI Connectors . 3. Cli", - "content": "MetaPKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n Endpoint issuing CA\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Endpoint * (string input) :\n\nThe MetaPKI Endpoint.\n\n Endpoint Issuing CA * (string select) :\n\nSelect the CA that will be issuing the certificates for this connector (from the imported Horizon CAs)\n\n Profile * (string input) :\n\nExample: Applications_Auth_Client_Serveur_SSL.\n\n Profile Cle * (string input) :\n\nExample: Serveur_SSL\n\n Workflow * (string input) :\n\nExample: S_LOCAL_SOFT\n\n Form Porteur Name (string input)\n\n Valid Days ( finite duration )\n\nCertificate lifetime in days (must be a valid finite duration).\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the MetaPKI PKI connector.\n\n GlobalSign MSSL\n MSAD Certificate Services", - "keywords": [ - "metapki", - "admin-guide", - "admin-guide/connectors/metapki", - "horizon", - "admin", - "guide", - "pkis", - "pki", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:msadcs", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Microsoft Active Directory Certificate Services PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/msadcs", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/msadcs.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/msadcs.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "MSAD Certificate Services" - ], - "summary": "Microsoft Active Directory Certificate Services PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites ADCS Connector installation guide must be completed prior to the configuration of this connector. Limitations All limit", - "content": "Microsoft Active Directory Certificate Services PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n ADCS Connector installation guide must be completed prior to the configuration of this connector.\n\n Limitations\n\n All limitations induced by the use of ADCS.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Endpoint * (string input) :\n\nURL to access the Web Enrollment ADCS component.\n\n Active Directory Domain Netbios Name * (string input) :\n\nThe Active Directory domain where to find the technical user and the ADCS server.\n\n Profile * (string input) :\n\nIt is recommended to duplicate default template, and grant the enrolment permissions to the created technical user. Example: Web Server\n\n CA Config * (string input) :\n\nThe CaConfig string, as given out by certutil -config for the considered ADCS CA. It’s usually in the form <ADCS Hostname>\\<CA CommonName>\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Signer PKCS#12 * (import) :\n\nImport the PKCS#12 file containing the signature certificate used to sign the CMP messages.\n\n Sign certificate password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n Technical account MSUPN * (string input) :\n\nCreate a user that has certificate issuance, revocation and management permissions at CA level and for the relevant certificates template.\n\n Technical account password * (string input) :\n\nPassword associated with aforementioned defined user.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Microsoft Active Directory Certificate Services PKI connector.\n\n MetaPKI\n Nexus Certificate Manager", - "keywords": [ - "microsoft", - "active", - "directory", - "certificate", - "services", - "pki", - "admin-guide", - "admin-guide/connectors/msadcs", - "horizon", - "admin", - "guide", - "pkis", - "connectors", - "msad" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:nexus", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Nexus Certificate Manager PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/nexus", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/nexus.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/nexus.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Nexus Certificate Manager" - ], - "summary": "Nexus Certificate Manager PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites A certificate procedure and a token procedure should be created. An authentication certificate should be issued for Horizon, and it should be", - "content": "Nexus Certificate Manager PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n A certificate procedure and a token procedure should be created.\n\n An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned token procedure.\n\n Nexus Endpoint CA\n\n Limitations\n\n Only the following fields are managed: commonName, UID, OU, O, C and subjectAltNames DNS, IPaddress, RFC822Name and msUPN .\n\n For multi-valued fields (SAN DNS, RFC822Name and IP address), if more data items are provided than configured in Nexus CM Procedure, the exceeding items will be ignored.\n\n All limitations induced by the use of the Nexus CM SDK.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill all mandatory fields:\n\n Nexus CM DNS name * (string input) :\n\nURL to access the Nexus Certificate Manager.\n\n Nexus endpoint CA * (select) :\n\nSelect the endpoint CA.\n\n Nexus CM Certificate procedure name * (string input) :\n\nThe token procedure name to use.\n\nShould point to the appropriate certificate procedure, and must be on PKCS#10 format.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Nexus Certificate Manager PKI connector.\n\n MSAD Certificate Services\n OpenTrust PKI", - "keywords": [ - "nexus", - "certificate", - "manager", - "pki", - "admin-guide", - "admin-guide/connectors/nexus", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:otpki", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "OpenTrust PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/otpki", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/otpki.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/otpki.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "OpenTrust PKI" - ], - "summary": "OpenTrust PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites A certificate profile should be created. An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocati", - "content": "OpenTrust PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n A certificate profile should be created.\n\n An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned certificate profile.\n\n Limitations\n\n Only the following fields are managed: commonName, userID, serialNumber, organizationalUnit, organization, country, adminEmail or contactEmail, msCertTemplateName and subjectAltNames DNS, IPadress, RFC822Name, msUPN and msGUID .\n\n For multi-valued fields (SAN DNS, IP address and RFC822Name), if more data items are provided than configured in OTPKI 'certificate template name', the exceeding items will be ignored.\n\n All limitations induced by the use of the RA SOAP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n OTPKI RA Connector URL * (string input) :\n\nMust point to the \"RA\" connector URL.\n\n OTPKI Certificate template name * (string input) :\n\nThe OTPKI certificate template to use.\n\n OTPKI zone (string input) :\n\nSpecify a zone (if used).\n\n Contact email mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n SAN DNS mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n SAN Email mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n UID mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the OpenTrust PKI connector.\n\n Nexus Certificate Manager\n Sectigo CMS", - "keywords": [ - "opentrust", - "pki", - "admin-guide", - "admin-guide/connectors/otpki", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:sectigo", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Sectigo CMS PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/sectigo", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/sectigo.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/sectigo.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Sectigo CMS" - ], - "summary": "Sectigo CMS PKI ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites For publicly trusted certificates, you need to validate the domain(s) for which you will issue certificates prior to their issuance. You need to retrieve t", - "content": "Sectigo CMS PKI\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n For publicly trusted certificates, you need to validate the domain(s) for which you will issue certificates prior to their issuance.\n\n You need to retrieve the customerUri and the organizationId from Sectigo CMS.\n\n You need to create a technical account with appropriate permissions including the allow ssl auto approve permission. You need to set a password for the technical account.\n\n Limitations\n\n Only the subjectAltName DNS field is managed.\n\n The certificate Subject DN will be set to whatever is specified in the PKCS#10 CSR.\n\n All limitations induced by the use of the Sectigo CMS REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Customer URI * (string input) :\n\nEnter the Customer URI. An integer is expected.\n\n Organization ID * (int input) :\n\nEnter the Organization ID.\n\n Profile (Certificate Type) * (string input) :\n\nEnter the Profile (Certificate Type). An integer is expected.\n\n Retry interval ( finite duration ) :\n\nPredefined interval of time before retrying to retrieve the certificate from Sectigo. Must be a valid finite duration. No default value is set.\n\n Valid Days ( finite duration ) :\n\nCertificate validity duration in days. Must be a valid finite duration. No default value is set.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Login * (string input) :\n\nEnter your Sectigo CMS login.\n\n Password * (string input) :\n\nEnter your Sectigo CMS password.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Sectigo CMS PKI connector.\n\n OpenTrust PKI\n Local Accounts", - "keywords": [ - "sectigo", - "cms", - "pki", - "admin-guide", - "admin-guide/connectors/sectigo", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:connectors:stream", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "EverTrust Stream CA", - "section": "admin-guide", - "slug": "admin-guide/connectors/stream", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/connectors/stream.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/stream.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "EverTrust Stream CA" - ], - "summary": "EverTrust Stream CA ⚠ Deprecated: This version reached LDOS on 16/05/2025. Prerequisites A certificate template should be created in Stream for Horizon to enroll certificates upon. A dedicated Horizon account should be created in Stream and", - "content": "EverTrust Stream CA\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Prerequisites\n\n A certificate template should be created in Stream for Horizon to enroll certificates upon.\n\n A dedicated Horizon account should be created in Stream and should have all lifecycle permissions on the desired CA. The credentials of this account should be either login and password or a PKCS#12 authentication certificate.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI > PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n Queue PKI (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be in valid finite duration.\n\n 7. Click on the next button\n\n 8. Fill all mandatory fields:\n\n Endpoint * (string input) :\n\nFill in the Stream endpoint url.\n\n Template * (sting input) :\n\nFill in the Stream certificate template to enroll upon.\n\n CA (string input) :\n\nFill in the Stream CA enrolling certificate (internal name).\n\n 9. Click on the next button.\n\n Authentication tab\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nPassword used to secure the aforementioned PKCS#12.\n\n Login * (string input) :\n\nEnter the login for the dedicated Horizon account on Stream.\n\n Password * (string input) :\n\nEnter the aforementioned account’s password .\n\n 10. Click on the save button.\n\n You can edit , duplicate or delete the Evertrust Stream PKI connector.\n\n EverTrust Integrated CA\n FISId", - "keywords": [ - "evertrust", - "stream", - "ca", - "admin-guide", - "admin-guide/connectors/stream", - "horizon", - "admin", - "guide", - "pkis", - "pki", - "connectors" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:discovery", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Discovery", - "section": "admin-guide", - "slug": "admin-guide/discovery", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/discovery.html", - "breadcrumbs": ["Horizon", "Admin guide", "Discovery"], - "summary": "Discovery ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure Discovery campaigns. An EverTrust Horizon Discovery campaign will contain all certificates discovered on a specific scope. A discovered c", - "content": "Discovery\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure Discovery campaigns. An EverTrust Horizon Discovery campaign will contain all certificates discovered on a specific scope.\n\n A discovered certificate can be:\n\n An unknown certificate.\n\n> All certificate information will be stored and this certificate will appear as an ' unmanaged ' certificate.\n\n An already discovered certificate (due to another Discovery campaign).\n\n> Discovery campaign metadata will be added to the existing certificate.\n\n A managed certificate.\n\n> Discovery campaign metadata will be added to the existing certificate.\n\n How to create a Discovery Campaign\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Discovery from the drawer or card: Discovery .\n\n 3. Click on .\n\n 4. Fill in all mandatory fields.\n\n General tab\n\n Campaign name * (string input) :\n\nEnter a meaningful Discovery campaign name.\n\n Description (string input) :\n\nEnter Discovery campaign description.\n\n Enabled (boolean) :\n\nEnable/Disable this Discovery campaign.\n\n Search (select) :\n\nSelect an authorization level to search this Discovery campaign.\n\n Feed (select) :\n\nSelect an authorization level to feed this Discovery campaign.\n\n Log event on success * (boolean) :\n\nEnable/Disable discovery event on success.\n\n Log event on failure * (boolean) :\n\nEnable/Disable discovery event on failure.\n\n Log event on warning * (boolean) :\n\nEnable/Disable discovery event on warning.\n\n Host tab\n\n Hosts (string input or int) :\n\nSpecify the target to scan. Can be hostname(s), IP address(es), IP range or CIDR address(es). It is possible to add several hostnames separated by commas.\n\n Port tab\n\n Ports (string input or int) :\n\nEnter the port(s) to scan on hosts. It is possible to add several ports separated by commas or to add a port range separated by an hyphen (ex : 1-1000 to go from 1 to 1000).\n\n Hosts and ports should only be set if you intend to perform a network scan using horizon-cli in order to discover the certificates. These parameters are ignored in all other discovery modes (local scan, third party import).\n\n 6. Click on the save button.\n\n You can edit , flush or delete the Discovery.\n\n How to flush a Discovery Campaign\n\n Flushing a Discovery campaign is the action to remove Discovery campaign reference from all discovered certificates.\n\n There are three different cases:\n\n If the certificate is not managed by Horizon (only discovered by a Discovery campaign) AND only referenced by the campaign you are willing to flush → The certificate will be removed from the Horizon database.\n\n If the certificate is not managed by Horizon but is referenced by at least another Discovery campaign → The certificate will NOT be removed from the database and only the Discovery metadata will be removed from the certificate.\n\n If the certificate is managed by Horizon → Only the Discovery metadata will be removed from the certificate.\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Discovery from the drawer or card: Discovery .\n\n 3. Click on .\n\n 4. Click on the Confirm button to perform the flush.\n\n Notifications\n ACME", - "keywords": [ - "discovery", - "admin-guide", - "admin-guide/discovery", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Introduction", - "section": "admin-guide", - "slug": "admin-guide/introduction", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/introduction.html", - "breadcrumbs": ["Horizon", "Admin guide", "Introduction"], - "summary": "Introduction ⚠ Deprecated: This version reached LDOS on 16/05/2025. Description Horizon is EverTrust’s Certificate lifecycle management solution and is powered up by: Akka BouncyCastle MongoDB Kamon Play! Framework Scala NGINX Vue.js Quasar", - "content": "Introduction\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Description\n\n Horizon is EverTrust’s Certificate lifecycle management solution and is powered up by:\n\n Akka\n\n BouncyCastle\n\n MongoDB\n\n Kamon\n\n Play! Framework\n\n Scala\n\n NGINX\n\n Vue.js\n\n Quasar\n\n This document is specific to Horizon version 2.3 .\n\n Scope\n\n This document is an administration guide detailing how to configure and operate Horizon.\n\n Out of Scope\n\n This document does not describe how to install and bootstrap a Horizon instance. Please refer to the installation guide for installation related tasks.\n\n Troubleshooting\n User Information", - "keywords": [ - "introduction", - "admin-guide", - "admin-guide/introduction", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:notifications", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Notifications", - "section": "admin-guide", - "slug": "admin-guide/notifications", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/notifications.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/notifications.html", - "breadcrumbs": ["Horizon", "Admin guide", "Notifications"], - "summary": "Notifications ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section explains how to configure notifications in Horizon. Horizon currently supports 2 types of notifications : mail notifications and instant messaging notificatio", - "content": "Notifications\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section explains how to configure notifications in Horizon.\nHorizon currently supports 2 types of notifications : mail notifications and instant messaging notifications.\n\n Email Notifications\n\n This section details how to configure the email notifications.\n\n How to create a mail notification\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access emails from the drawer or card: Notifications > Emails .\n\n 3. Click on .\n\n 4. Fill in all mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful mail notification name.\n\n Event type * (select) :\n\nSelect the event type to notify (certificate or request).\n\n Event * (select) :\n\nSelect the event to notify.\n\n Retries in case of error (int) :\n\nSelect the number of times Horizon should retry to send the notification in case of error. The default value is set to 10.\n\n From *: (string input)\n\nEnter the email address that will appear in the email \"From\" field.\n\n To *: (select multiple & input multiple)\n\nSelect one or several recipients. You may also enter an email address.\n\n Subject * (string input) :\n\nEnter the email subject. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon email generation.\n\n Body * (string input) :\n\nEnter the email body. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon email generation.\n\n Is HTML (boolean) :\n\nSets whether the email body contains HTML code (true) or plain text (false). The default value is set to false.\n\n You can click on the \"+\" next to \"How to use dynamic attributes\" in order to get a range of possibilities from which one or more may be chosen.\n\n In case you selected any Certificate type event any Request type event but the Enroll requests ones:\n\n Attachments (list) :\n\nSets whether to attach the certificate to the email notification and which format to use for the attached certificate (if any).\n\n Attach certificate (PEM) attaches the certificate under PEM format\n\n Attach bundle (PEM) attaches the certificate as well as the entire trust chain used to sign it in PEM format\n\n Attach certificate (PKCS#7) attaches the certificate under PKCS#7 format\n\n Attach bundle (PKCS#7) attaches the certificate as well as the entire trust chain used to sign it in PKCS#7 format\n\n Attach certificate (DER) attaches the certificate under DER format\n\n In case you selected *Certificate Expiration* :\n\n Duration before certificate expiration causing the notification * ( finite duration ) :\n\nSets how long before certificate expiration the email notification should be sent. The default value is set to 5 days.\n\n Run on renewed (boolean) :+\nSets whether the expiration notification should be sent even though the certificate has been renewed. Default value is set to false (if the certificate has been renewed, the notification will not be sent).\n\n In case you selected as an Event Enroll request Approval or Recover request Approval :\n\n Attach PKCS#12 (set at false) (boolean) :\n\nSets whether the certificate in PKCS#12 format (certificate + private key encrypted by password) should be attached to the email. The default value is set to false.\n\n Send email if (select unique) :\n\nSelect either Always - Centralized (Horizon generates the private key) - Decentralized (a CSR is provided to Horizon). The default value is set to Always.\n\n In case you selected as an Event Enroll request Pending or Revoke request Pending or Recover request Pending or Update request Pending or Migrate Request Pending :\n\n Duration after request submission causing the notification * ( finite duration ) :\n\nDuration after request submission causing the notification to be sent, in case the request was not approved in the meantime. The default value is set to 5 days.\n\n 6. Click on the save button.\n\n You can edit , duplicate or delete the Email Notification .\n\n Messaging\n\n This section details how to configure the messaging notifications.\n\n Prerequisites\n\n You will need a webhook URL from the messaging tools in order to send notification.\n\n How to create a Messaging notification\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Messaging from the drawer or card: Notifications > Messaging .\n\n 3. Click on .\n\n 4. Fill in all mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful email notification name.\n\n Event type * (select) :\n\nSelect the event type to notify (certificate or request).\n\n Event * (select) :\n\nSelect the event to notify.\n\n Retries in case of error (int) :\n\nSelect the number of times Horizon should retry to send the notification in case of error.The default value is set to 10.\n\n Timeout * ( finite duration ) :\n\nThe time before Horizon stop trying to connect to Webhook or Proxy.\n\n Proxy (option) :\n\nThe HTTP/HTTPS proxy to use to reach the messaging tool, if any.\n\n To * (select) :\n\nSelect one of:\n\n Static\n\n Teams webhook\n\n Title * (string input) :\n\nEnter the title of the instant messaging. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon notification generation.\n\n Body * (string input) :\n\nEnter the body of the instant messaging. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon notification generation.\n\n You can click on the \"+\" next to \"How to use dynamic attributes\" in order to get a range of possibilities from which one or more may be chosen.\n\n In case you selected as an Event Certificate Expiration :\n\n Duration before certificate expiration causing the notification * ( finite duration ) :\n\nSets how long before certificate expiration the messaging notification should be sent. The default value is set to 5 days.\n\n In case you selected as an Event Enroll request Pending or Revoke request Pending or Recover request Pending or Update request Pending or Migrate request Pending :\n\n Duration after request submission causing the notification * ( finite duration ) :\n\nDuration after request submission causing the messaging notification to be sent, in case the request was not approved in the meantime. The default value is set to 5 days.\n\n 6. Click on the save button.\n\n You can edit , duplicate or delete the Messaging Notification.\n\n Teams\n Discovery", - "keywords": [ - "notifications", - "admin-guide", - "admin-guide/notifications", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:other:cron", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Cron Expression", - "section": "admin-guide", - "slug": "admin-guide/other/cron", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/other/cron.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/other/cron.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Common configuration elements", - "Cron Expression" - ], - "summary": "Cron Expression ⚠ Deprecated: This version reached LDOS on 16/05/2025. Cron expressions are composed of 6 required fields and one optional field separated by white spaces. The fields are respectively described as follows: Field Name Allowed", - "content": "Cron Expression\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Cron expressions are composed of 6 required fields and one optional field separated by white spaces. The fields are respectively described as follows:\n\n Field Name\n Allowed Values\n Allowed Special Character\n\n Seconds\n\n 0-59\n\n - * /\n\n Minutes\n\n 0-59\n\n - * /\n\n Hours\n\n 0-23\n\n - * /\n\n Day-of-month\n\n 1-31\n\n - * ? / L W\n\n Month\n\n 1-12 or JAN-DEC\n\n - *\n\n Day-of-Week\n\n 1-7 or SUN-SAT\n\n - * ? / L #\n\n Year (Optional)\n\n empty, 1970-2199\n\n - * /\n\n Special characters\n\n * (\"all values\") - used to select all values within a field. For\nexample, \"*\" in the minute field means every minute .\n\n ? (\"no specific value\") - useful when you need to specify something\nin one of the two fields in which the character is allowed, but not the\nother. For example, if I want my trigger to fire on a particular day of\nthe month (say, the 10th), but don’t care what day of the week that\nhappens to be, I would put \"10\" in the day-of-month field, and \"?\" in\nthe day-of-week field. See the examples below for clarification.\n\n - - used to specify ranges. For example, \"10-12\" in the hour field\nmeans \"the hours 10, 11 and 12\".\n\n , - used to specify additional values. For example, \"MON,WED,FRI\" in\nthe day-of-week field means \"the days Monday, Wednesday, and Friday\".\n\n / - used to specify increments. For example, \"0/15\" in the seconds\nfield means \"the seconds 0, 15, 30, and 45\". And \"5/15\" in the seconds\nfield means \"the seconds 5, 20, 35, and 50\". You can also specify '/'\nafter the '*' character - in this case '*' is equivalent to having '0'\nbefore the '/'. '1/3' in the day-of-month field means \"fire every 3 days\nstarting on the first day of the month\".\n\n L (\"last\") - has different meaning in each of the two fields it is allowed\ninto. For example, the value \"L\" in the day-of-month\nfield means \"the last day of the month\" - day 31 for January, day 28 for\nFebruary on non-leap years. If used in the day-of-week field by itself,\nit simply means \"7\" or \"SAT\". But if used in the day-of-week field after\nanother value, it means \"the last xxx day of the month\" - for example\n\"6L\" means \"the last Friday of the month\". You can also specify an\noffset from the last day of the month, such as \"L-3\" which would mean\nthe third-to-last day of the calendar month. When using the 'L' option,\nit is important not to specify lists, or ranges of values, as you’ll get\nconfusing/unexpected results.\n\n W (\"weekday\") - used to specify the weekday (Monday-Friday) nearest\nthe given day. As an example, if you were to specify \"15W\" as the value\nfor the day-of-month field, the meaning is: \"the nearest weekday to the\n15th of the month\". So if the 15th is a Saturday, the trigger will fire\non Friday the 14th. If the 15th is a Sunday, the trigger will fire on\nMonday the 16th. If the 15th is a Tuesday, then it will fire on Tuesday\nthe 15th. However if you specify \"1W\" as the value for day-of-month, and\nthe 1st is a Saturday, the trigger will fire on Monday the 3rd, as it\nwill not 'jump' over the boundary of a month’s days. The 'W' character\ncan only be specified when the day-of-month is a single day, not a range\nor list of days.\n\n # - used to specify \"the nth\" XXX day of the month. For example, the\nvalue of \"6#3\" in the day-of-week field means \"the third Friday of the\nmonth\" (day 6 = Friday and \"#3\" = the 3rd one in the month). Other\nexamples: \"2#1\" = the first Monday of the month and \"4#5\" = the fifth\nWednesday of the month. Note that if you specify \"#5\" and there is not 5\nof the given day-of-week in the month, then no firing will occur that\nmonth.\n\n The 'L' and 'W' characters can also be combined\nin the day-of-month field to yield ' LW ', which translates to \"last\nweekday of the month\" .\n\n HTTP Proxy\n Finite Duration", - "keywords": [ - "cron", - "expression", - "admin-guide", - "admin-guide/other/cron", - "horizon", - "admin", - "guide", - "common", - "configuration", - "elements" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:other:duration", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Finite Duration", - "section": "admin-guide", - "slug": "admin-guide/other/duration", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/other/duration.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/other/duration.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Common configuration elements", - "Finite Duration" - ], - "summary": "Finite Duration ⚠ Deprecated: This version reached LDOS on 16/05/2025. The format of a Finite Duration is \"<length><unit>\" , where: White space is allowed between the parts. Length is a positive integer without the \"+\" sign. Val", - "content": "Finite Duration\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n The format of a Finite Duration is \"<length><unit>\" , where:\n\n White space is allowed between the parts.\n\n Length is a positive integer without the \"+\" sign.\n\n Valid possible units are described in the below table:\n\n Unit\n Short name\n Long names\n\n DAYS\n\n d\n\n day days\n\n HOURS\n\n h\n\n hour hours\n\n MINUTES\n\n m\n\n min mins minute minutes\n\n SECONDS\n\n s\n\n sec secs second seconds\n\n MILLISECONDS\n\n ms\n\n milli millis millisecond milliseconds\n\n For example, 10 seconds will be written as \"10 s\", \"10s\", \"10 sec\" or \"10 seconds\".\n\n Cron Expression\n Reports", - "keywords": [ - "finite", - "duration", - "admin-guide", - "admin-guide/other/duration", - "horizon", - "admin", - "guide", - "common", - "configuration", - "elements" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:pki_admin", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "PKI Connectors", - "section": "admin-guide", - "slug": "admin-guide/pki_admin", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/pki_admin.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/pki_admin.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "General Information" - ], - "summary": "PKI Connectors ⚠ Deprecated: This version reached LDOS on 16/05/2025. Description A \"PKI Connector\" is a configuration piece that allows to establish the communication with any supported PKI. Additionally, it enables to map a specific certi", - "content": "PKI Connectors\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Description\n\n A \"PKI Connector\" is a configuration piece that allows to establish the communication with any supported PKI. Additionally, it enables to map a specific certificate profile within the connected PKI.\n\n Common prerequisites\n\n To grant \"Horizon\" proper access to a given PKI, three categories of requirements must be gathered:\n\n Credentials : It could be either certificates (PKCS#12 format) or technical accounts (login/password) allowing to authenticate against the PKI API.\n\n Permissions : The credentials must be granted with the proper permissions on the PKI in order to be able to manage certificate lifecycle (enroll, revoke, renew).\n\n Profile/Certificate information : This information is used to map certificate types and/or certificate fields.\n\n PKI Queue\n AWS", - "keywords": [ - "pki", - "connectors", - "admin-guide", - "admin-guide/pki_admin", - "horizon", - "admin", - "guide", - "pkis", - "general", - "information" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:pki_queue", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "PKI Queue", - "section": "admin-guide", - "slug": "admin-guide/pki_queue", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/pki_queue.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/pki_queue.html", - "breadcrumbs": ["Horizon", "Admin guide", "PKIs", "PKI Queue"], - "summary": "PKI Queue ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure a PKI Queue. PKI Queue are used to limit the PKI requests (enrollment, revocation) PKI Queue Configuration 1. Log in to Horizon Administr", - "content": "PKI Queue\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure a PKI Queue. PKI Queue are used to limit the PKI requests (enrollment, revocation)\n\n PKI Queue Configuration\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI Queues from the drawer or card: PKI > PKI Queues .\n\n 3. Click on .\n\n 4. Fill in the fields:\n\n Name * (string input) :\n\nChoose a meaningful queue name. It must be unique.\n\n Description (string input) :\n\nThe description for the PKI Queue.\n\n Throttle Parallelism (int input) :\n\nNumber of requests processed at the same time.\n\n Throttle Duration ( finite duration ) :\n\nMaximum requests processed at the same time in a given duration. Parallelism must be set.\n\n Max Size * (int input) :\n\nMaximum requests stored in the queue\n\n Cluster Wide (boolean) :\n\nIf not enabled, then the throttleParallelism and throttleDuration will be the same for all nodes in the cluster.\nIf enabled, then the throttleParallelism and throttleDuration is generalized for all clusters.\n\n If the queue is full every new request will be discarded.\n\n Certification Authorities\n General Information", - "keywords": [ - "pki", - "queue", - "admin-guide", - "admin-guide/pki_queue", - "horizon", - "admin", - "guide", - "pkis" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:protocols", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Common configuration elements for profiles", - "section": "admin-guide", - "slug": "admin-guide/protocols", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "Common configuration elements for profiles" - ], - "summary": "Common configuration elements for profiles ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure sections that are common to all profiles Common configuration for profiles tab Common configuration for ", - "content": "Common configuration elements for profiles\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure sections that are common to all profiles\n\n Common configuration for profiles tab\n\n Common configuration for profiles\n\n Languages\n\n 1. Click on add button.\n\n 2. Fill in the mandatory fields.\n\n Language * (string input) :\n\nSelect a language.\n\n Display Name * (string input) :\n\nEnter a display name.\n\n Description (string input) :\n\nEnter a description.\n\n You can add more by clicking on the add button again or delete the language.\n\n Labels\n\n 1. Click on add button.\n\n 2. Fill in the mandatory fields.\n\n Element * (string input) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nTells whether the label is mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label is editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label. This value must comply with the value restriction.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Enter the label value and press \"enter\" to add this value to the accepted value list.\n\n Regex (string input) :\n\nThe label value will have to match the regex. Enter the regular expression en click on the check button to set the regex.\n\n You can delete or reorder (drag and drop) the label template.\n\n Owner Policy\n\n 1. Specify the request’s owner policy (only used in EST, SCEP and WEBRA prevalidated request).\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Team Policy\n\n 1. Specify the request’s team policy (only used in EST, SCEP and WebRA prevalidated request).\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist.\n\n Regex (string input) :\n\nThe team will have to match the regex. Enter the regular expression and click on the check button to set the regex.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Metadata policy (overridable metadata)\n\n==\nMetadata are used by Horizon or Third party connectors, updating them should be done with utmost care.\n==\n\n==\nThe contact email metadata default value is set to editable by the requester and the approver.\n==\n\n 1. Click on add button.\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n Authorization Levels\n\n 1. Select an authorization level for each workflow.\n\n *Everyone:\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live (TTL)\n\n 1. Enter a time for each request.\n\n Enrollment request * ( finite duration ) :\n\nMust be in valid finite duration. The default value is set to one hour.\n\n Revocation request * ( finite duration ) :\n\nMust be in valid finite duration. The default value is set to one hour.\n\n Update request * ( finite duration ) :\n\nMust be in valid finite duration. The default value is set to one hour.\n\n Migration request * ( finite duration ) :\n\nMust be in valid finite duration. The default value is set to one hour.\n\n Recover request ( finite duration ) :\n\nMust be in valid finite duration. This field is enabled when Private key escrowing is set to on (Specfic configuration tab > Crypto Policy).\n\n Constraints\n\n ACME, EST, SCEP and WCCE protocols.\n\n 1. Fill in the mandatory fields.\n\n RSA Minimal Key size (select) :\n\nSelect the allowed RSA key size(s).\n\n Allowed EC curves (select) :\n\nSelect the allowed elliptic curve algorithms.\n\n Allowed email domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n Allowed DNS domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n CSR Data Mapping\n\n 1. Click on add button.\n\n 2. Select a field and enter a value.\n\n You can add more by clicking on the add button again or delete the CSR Data Mapping.\n\n Notification\n\n Notifications configuration tab\n\n Prerequisites\n\n Mail , Messaging\n\n How to manage Notification for profiles\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n 1. Chose notifications to be sent on certificate event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a request:\n\n Enroll/Revocation/Update/Migrate request :\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n You can delete the Notification for profile.\n\n WebRA\n AWS Certificate Manager Integration", - "keywords": [ - "common", - "configuration", - "elements", - "for", - "profiles", - "admin-guide", - "admin-guide/protocols", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:protocols:acme", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "ACME", - "section": "admin-guide", - "slug": "admin-guide/protocols/acme", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/acme.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/acme.html", - "breadcrumbs": ["Horizon", "Admin guide", "Protocols", "ACME"], - "summary": "ACME ⚠ Deprecated: This version reached LDOS on 16/05/2025. Introduction This section details how to configure and consume the ACME protocol. Horizon implements an ACME service respecting the RFC 8555 and more specifically the following lif", - "content": "ACME\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Introduction\n\n This section details how to configure and consume the ACME protocol.\n\n Horizon implements an ACME service respecting the RFC 8555 and more specifically the following lifecycle workflows:\n\n Enrollment;\n\n Renewal (which is equivalent to an enrollment);\n\n Revocation.\n\n Managing certificate lifecycle through the ACME protocol involves up to three components:\n\n Horizon as the ACME endpoint;\n\n An asset executing an ACME client or directly integrating the ACME protocol;\n\n When ACME validation is ' dns-01 ', DNS server(s).\n\nACME validation modes will be detailed later on.\n\n The protocol paradigm can be described as follows: ' if the asset can prove it has authority on the DNS names (called identifiers in ACME) it is requesting for, the certificate should be automatically enrolled / renewed ', which is basically equivalent to a Domain Validation .\n\n The following schema is a simplified workflow of an ACME enrollment:\n\nThe protocol is based on the notion of challenge and offers three validation modes to actually verify challenges and prove that the asset owns authority on the requested DNS name(s), i.e. ACME identifiers:\n\n http-01 : For each requested identifier, Horizon will validate the challenge by connecting back in HTTP on the configured http-01 validation port (TCP/80 by default) and retrieve the response to the challenge;\n\n tls-alpn-01 : For each requested identifier, Horizon will validate the challenge by connecting back in HTTPS on the configured tls-alpn-01 validation port (TCP/443 by default) and extract the response to the challenge from an ALPN extension in the asset / client HTTPS response;\n\n dns-01 : For each requested identifier, Horizon will validate the challenge through a DNS request and look for a specific TXT entry containing the response corresponding to the challenge for the considered identifier.\n\n Therefore, validation modes have the following constraints:\n\n http-01 and tls-alpn-01 :\n\n Horizon must be able to access the asset on the validation port;\n\n The validation port must be available and opened on the asset;\n\n dns-01 : the ACME client must be configured with DNS credentials owning the permission to create TXT records on the requested domain(s).\n\nFor http-01 and tls_alpn-01 validation modes, it is possible to configure an HTTP proxy to proxify the ACME validation tentative(s). Using an HTTP proxy is useful when http-01 and/or tls-alpn-01 validation need to be performed on asset(s) hosted within a DMZ where incoming network streams must be limited. In this scenario, an HTTP proxy is configured to relay ACME validations coming from the Horizon nodes within the DMZ and a unique incoming stream needs to be open to allow communication from Horizon node to the HTTP proxy.\n\n The choice of the validation mode to use mainly depends on the architecture. Here are the EverTrust recommendations:\n\n If the requester is not the asset, prefer the dns-01 validation mode;\n\n If the requester is the asset:\n\n If the asset is reachable from Horizon nodes, prefer the http-01 ;\n\n If the asset is not reachable from Horizon nodes, prefer the dns-01 ;\n\n tls-alpn-01 is the most complicated validation mode to implement and therefore should only be used when no other validation mode is an option.\n\n Qualified ACME clients\n\n EverTrust qualifies the following ACME clients for any release of the Horizon product:\n\n Linux ACME clients:\n\n acme.sh\n\n certbot\n\n lego\n\n Windows ACME client:\n\n lego\n\n WinCertes : this open source client is developed and maintained by EverTrust, therefore officially supported\n\n Kubernetes: cert-manager\n\nIf an ACME client is not listed above, it does not necessarily mean that the client will not work with Horizon, only that the client is not included in the list of clients tested in Horizon’s continuous integration test cases.\n\n ACME Profile\n\n This section details how to configure an ACME Profile.\n\n Prerequisites\n\n On Horizon side, you need to set up:\n\n PKI Connector\n\n How to configure ACME Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access ACME Profile from the drawer or card: Protocols > ACME .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of a URL, it is advisable to use only lower case letters and dashes.\n\n Enabled * (boolean) :\n\nIndicates whether the profile is enabled or not. The default value is set to true.\n\n PKI Connector (select) :\n\nSelect a PKI connector previously created.\n\n Max certificate per holder (int) :\n\nIf specified, defines the maximum number of active certificates for a given Holder. If the number of active certificates exceeds this parameter, then the oldest certificate(s) above the limit will be automatically revoked.\n\n Validations\n\n Validation Methods (select) :\n\nSelect the authorized ACME validation method(s) on the considered profile ( HTTP-01 and/or TLS-ALPN-01 and/or DNS-01 ).\n\n HTTP_01 validation port (int) :\n\nHTTP port to perform the http-01 validation. The default value is set to 80.\n\n TLS-ALPN_01 validation port (int) :\n\nHTTPS port to perform the tls-alpn-01 validation. The default value is set to 443.\n\n Challenge verification attempts * (int) :\n\nSpecify the number of time Horizon should try to validate an ACME challenge. Th default value is set to 3.\n\n Challenge verification retry delay * ( finite duration ) :\n\nSpecify the time duration Horizon should wait between two consecutive validations for the same challenge. The default value is set to 3 seconds.\n\n Proxy (select) :\n\nSpecify an HTTP proxy to use when performing http-01 or tls-alpn-01 validations.\n\n Timeout * ( finite duration ) :\n\nSpecify the time duration Horizon should wait when performing http-01 , tls-alpn-01 or dns-01 validations.\n\n Requests management\n\n Authorized short name (boolean) :\n\nSpecify if using short name is authorized when requesting certificate. If set to yes, one verifiable FQDN must be requested for each specified short name. The default value is set to false.\n\n Authorized empty contact (boolean) :\n\nSpecify if an ACME account can be registered without specifying a contact email address. Default to false.\n\n Default contacts mail (string input multiple) :\n\nSpecify a list of default contact email addresses when registering an ACME account with no specified contact email address.\n\n Max DNS name (int) :\n\nIf specified, enforce the maximum number of requested DNS name(s).\n\n Meta\n\n Is required terms of service (boolean) :\n\nSpecify if explicitly agreeing to the terms of service is required when registering an ACME account. The default value is set to false.\n\n Terms of service (string input) :\n\nSpecify an URL identifying the current terms of service.\n\n Website (string input) :\n\nSpecify an HTTP or HTTPS URL locating a website providing more information about the ACME server.\n\n CAA Identities (string input) :\n\nThe hostnames that the ACME server recognizes as referring to itself for the purposes of CAA record validation as defined in RFC6844 .\n\n Self Permissions\n\n Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to revoke the certificate with no validation workflow. Set to false by default.\n\n Request Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request the revocation of the certificate. Set to false by default.\n\n Update (boolean) :\nSpecify whether the certificate’s owner is authorized to update the certificate with no validation workflow. The default value is set to false.\n\n Request Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request certificate’s update. The default value is set to false.\n\n You can further configure the profile using the Common configuration for profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the ACME Profile.\n\n You won’t be able to delete an ACME Profile if it is referenced somewhere else.\n\n ACME client usages\n\n This section details how to use the most common Linux and Windows ACME clients.\n\n Linux ACME clients\n\n This section details how to use the acme.sh and certbot ACME clients.\n\n Overview\n\n Certbot is able to run on any recent UNIX-like operating system equipped with Python 2.7 or 3.4+, while acme.sh can also run on any recent Linux distribution running either bash, dash or sh.\n\n They both fully support the latest ACMEv2 protocol including its main latest feature: wildcard certificates (*.example.com).\n\n Both clients supports different modes for obtaining a certificate and in some cases automatically installing it.\n\n The following tables lists the different modes for each clients:\n\n Modes\n certbot\n acme.sh\n Notes\n\n apache\n\n Y\n\n Y\n\n Obtains and automatically installs a certificate using the running Apache server. (For acme.sh, this mode will only obtain a certificate without installing it)\n\n nginx\n\n Y\n\n Y\n\n Obtains and automatically installs a certificate using the running NGINX server. (For acme.sh, this mode will only obtain a certificate without installing it)\n\n webroot\n\n Y\n\n Y\n\n Obtains a certificate by writing to the webroot directory of an already running web server\n\n standalone\n\n Y\n\n Y\n\n Uses a \"standalone\" web server managed by Certbot or acme.sh. This mode is useful on system with no web servers or if using the running web server is not desired\n\n DNS\n\n Y\n\n Y\n\n This mode automates obtaining a certificate by modifying a DNS record to prove the control over a domain\n\n tls-alpn\n\n N\n\n Y\n\n Uses a TLS server to validate the control over a domain\n\n Requesting a certificate\n\n Both clients must be started using administrative privileges ( sudo ), except for acme.sh when using the webroot or DNS modes.\n\n Each client requires only a few parameters to request a certificate.\n\n acme.sh parameters:\n\n Parameter\n Description\n\n -issue\n\n Obtain or renew a certificate, but does not install it\n\n -w [VALUE]\n\n Path of the server’s webroot folder\n\n -d [VALUE]\n\n The domain(s) to enroll.\n\n certbot parameters:\n\n Parameter\n Description\n\n certonly\n\n Obtain or renew a certificate, but does not install it\n\n –webroot\n\n Place files in a server’s webroot folder for authentication\n\n -w [VALUE]\n\n Path of the server’s webroot folder\n\n -d [VALUE]\n\n The domain(s) to enroll.\n\n Requesting a certificate for Apache using certbot:\n\n (sudo) certbot run --apache --no-eff-email --agree-tos --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -m <contact email address, example: [email protected] > --domain <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --apache : Enables the Apache mode\n\n --no-eff-email : Does not share your email address with EFF\n\n --agree-tos : Explicitly agrees to the terms of service\n\n --server : Horizon ACME profile endpoint\n\n -m : Contact email address\n\n --domain : Requested DNS name (can be specified several times)\n\n Requesting a certificate for nginx using certbot:\n\n (sudo) certbot run --nginx --no-eff-email --agree-tos --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -m <contact email address, example: [email protected] > --domain <DNS name, example: nginx.evertrust.fr>\n\n Where:\n\n --nginx : Enables the nginx mode\n\n --no-eff-email : Does not share your email address with EFF\n\n --agree-tos : Explicitly agrees to the terms of service\n\n --server : Horizon ACME profile endpoint\n\n -m : Contact email address\n\n --domain : Requested DNS name (can be specified several times)\n\n Requesting a certificate for nginx using acme.sh:\n\n (sudo) acme.sh --issue --nginx --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> --accountemail <contact email address, example: [email protected] > -d <DNS name, example: nginx.evertrust.fr>\n\n Where:\n\n --issue : Specifies that this is a certificate request\n\n --nginx : Enables the nginx mode\n\n --server : Horizon ACME profile endpoint\n\n --accountemail : Contact email address\n\n -d : Requested DNS name (can be specified several times)\n\n Requesting a certificate in standalone mode using certbot:\n\n (sudo) certbot certonly --standalone --no-eff-email --agree-tos --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -m <contact email address, example: [email protected] > --domain <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --standalone : Enables the standalone mode, i.e. certbot will start a local web server to server the response\n\n --no-eff-email : Does not share your email address with EFF\n\n --agree-tos : Explicitly agrees to the terms of service\n\n --server : Horizon ACME profile endpoint\n\n -m : Contact email address\n\n --domain : Requested DNS name (can be specified several times)\n\n Requesting a certificate in standalone mode using acme.sh:\n\n (sudo) acme.sh --issue --standalone --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> --accountemail <contact email address, example: [email protected] > -d <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --issue : Specifies that this is a certificate request\n\n --standalone : Enables the standalone mode, i.e. acme.sh will start a local web server to server the response\n\n --server : Horizon ACME profile endpoint\n\n --accountemail : Contact email address\n\n -d : Requested DNS name (can be specified several times)\n\n Revoking a certificate\n\n Revoking a certificate using certbot:\n\n (sudo) certbot revoke --cert-path <path of the certificate to revoke> --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory>\n\n Where:\n\n --cert-path : Specifies the path of the certificate to revoke\n\n --server : Horizon ACME profile endpoint\n\n Revoking a certificate using acme.sh:\n\n (sudo) acme.sh --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> --revoke -d <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --server : Horizon ACME profile endpoint\n\n -d : DNS name of the certificate to revoke\n\n Windows ACME clients\n\n This section details how to use the WinCertes ACME client.\n\n Overview\n\n WinCertes is a simple and efficient CLI-based client made to run on any Windows Server ( > Windows Server 2008 R2 SP1 (64 bits)) and running .NET 4.6.1 or higher.\n\n The client fully supports ACMEv2 including its latest feature, along with the support of wildcard certificates (*.example.com).\n\n WinCertes eases certificate installation and renewal by automatically binding them to the appropriate web site on IIS and by creating a Scheduled Task that will check the expiration date of the certificates and trigger a renewal if necessary.\n\n WinCertes offers the possibility to launch a PowerShell script upon the successful retrieval of a certificate. This feature enables advanced deployment on Exchange or multi-servers for instance.\n\n The client supports two validation modes for validating the identity of the certificate requester:\n\n HTTP challenge validation\n\n With the ability to support the running IIS web server or to use an embedded standalone web server for easier configuration.\n\n DNS challenge validation\n\n Support for Windows DNS Server\n\n Support for acme-dns\n\n Requesting a certificate\n\n To request a certificate using WinCertes, the Windows command line ( cmd.exe ) must be run as Administrator.\n\n Then WinCertes requires only a few parameters to request a certificate:\n\n Parameter\n Description\n\n -d [VALUE]\n\n The domain(s) to enroll\n\n -w\n\n toggle the local web server use and sets its ROOT directory (default c:\\inetpub\\wwwroot ).\n\nActivates HTTP validation mode.\n\n -b [VALUE]\n\n The name of the IIS web site to bind the certificate to\n\n -p\n\n Used to make WinCertes create a Scheduled Task to handle certificate renewal\n\n There are many more options to customize the requests to specific needs.\n\n Requesting a certificate for IIS using WinCertes:\n\n (as administrator) wincertes -s <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -w -b <IIS Site Name, example: \"Default Web Site\"> -p -e <contact email address, example: [email protected] > -d <DNS name, example: iis.evertrust.fr>\n\n Where:\n\n -s : Horizon ACME profile endpoint\n\n -w : Enables standalone mode, i.e. WinCertes will start a local web server to serve the response\n\n -b : IIS Web Site name\n\n -p : Registers a scheduled task to enable certificate automated renewal\n\n -e : Contact email address\n\n Discovery\n EST", - "keywords": [ - "acme", - "admin-guide", - "admin-guide/protocols/acme", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:protocols:est", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "EST", - "section": "admin-guide", - "slug": "admin-guide/protocols/est", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/est.html", - "breadcrumbs": ["Horizon", "Admin guide", "Protocols", "EST"], - "summary": "EST ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section refers to the EST protocol, as described by RFC 7030 . EST Profile This section details how to configure the EST Profile Prerequisites PKI How to configure EST Profile ", - "content": "EST\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section refers to the EST protocol, as described by RFC 7030 .\n\n EST Profile\n\n This section details how to configure the EST Profile\n\n Prerequisites\n\n PKI\n\n How to configure EST Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access EST Profile from the drawer or card: Protocol > EST .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon use the name to identify the profile.\n\n Enabled (boolean) :\n\nTells whether the profile is enabled or not.\nThe default value is set to true.\n\n PKI (select) :\n\nSelect a PKI Connector previously created.\n\n Max certificates per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Crypto Policy\n\n Decentralized enrollment (boolean) :\n\nTells whether the profile should be used with a decentralized enrollment mode, i.e CSR (PKCS#10) signing by the PKI.\nThe default value is set to true.\n\n Centralized enrollment (boolean) :\n\nTells whether the profile should be used with a centralized enrollment, i.e providing a PKCS#12.\nThe default value is set to false.\n\n Private key escrowing (boolean) :\n\nTells whether the private key should be escrowed by Horizon. (only for Centralized enrollment )\nThe default value is set to false.\n\n Key type (select) :\n\nSelect the type of key to generate when using centralized enrollment mode.\n\n Password policy for PKCS#12 password * (select) :\n\nSelect a password policy previously created.\n\n Store encryption type (select) :\n\nSelect from the list the encryption type.\nThe default value is set to DES_AVERAGE.\n\n Show PKCS#12 Password On Recover (boolean) :\n\nTells whether the PKCS#12 password should be displayed on recover. Enabled when Private key escrowing is set to on.\nThe default value is set to false.\n\n Show PKCS#12 On Recover (boolean) :\n\nTells whether the PKCS#12 should be displayed on recover. Enabled when Private key escrowing is set to on.\nThe default value is set to false.\n\n Authorization and validation\n\n Authorization mode (select) :\n\nSelect from the list.\n\n Authorized :\n\n Enabled whitelist (boolean) :\n\nTells whether whitelist is enabled or not. The default value is set to false.\n\n CA * (select) :\n\nSelect a Certificate Authority previously created.\n\n X509 :\n\n Enrollment CAs (select) :\n\nAvailable only if mode at x509. Select a Certificate Authority previously created.\n\n Enabled whitelist (boolean) :\n\nTells whether whitelist is enabled or not. The default value is set to false.\n\n CA * (select) :\n\nSelect a Certificate Authority previously created.\n\n Challenge :\n\n Password policy (select) :\n\nSelect a password policy previously created. It is used for the challenge generation.\n\n Enabled whitelist (boolean) :\n\nTells whether whitelist is enabled or not. The default value is set to false.\n\n CA * (select) :\n\nSelect a Certificate Authority previously created.\n\n Renewal management\n\n Renewal period: ( finite duration ) :\n\nMust be a valid finite duration.\n\n Renewal CAs (select) :\n\nSelect a Certificate Authority previously created.\n\n Revoke on renew (boolean) :\n\nThe previous certificate will be revoked on renew if true. The default value is set to false.\n\n Revocation reason (select) :\n\nSelect the reason from the list. Available only if \"revoke on renew\" value is set to true.\n\n Self Permissions\n\n Revoke (boolean) :\n\nTells whether self revoke permission is granted or not. The default value is set to false.\n\n Request Revoke (boolean) :\n\nTells whether self request revoke permission is granted or not. The default value is set to false.\n\n Update (boolean) :\n\nTells whether self update permission is granted or not. The default value is set to false.\n\n Request Update (boolean) :\n\nTells whether self request update permission is granted or not. The default value is set to false.\n\n Recover (boolean) :\n\nTells whether self recover permission is granted or not. The default value is set to false.\n\n Request recover (boolean) :\n\nTells whether self request recover permission is granted or not. The default value is set to false.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the EST Profile.\n\n You won’t be able to delete a EST Profile if this one is referenced somewhere else.\n\n ACME\n SCEP", - "keywords": [ - "est", - "admin-guide", - "admin-guide/protocols/est", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:protocols:scep", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "SCEP", - "section": "admin-guide", - "slug": "admin-guide/protocols/scep", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/scep.html", - "breadcrumbs": ["Horizon", "Admin guide", "Protocols", "SCEP"], - "summary": "SCEP ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section refers to the SCEP protocol, as described by RFC 8894 . SCEP Profile This section details how to configure the SCEP Profile Prerequisites PKI Connector SCEP Authority ", - "content": "SCEP\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section refers to the SCEP protocol, as described by RFC 8894 .\n\n SCEP Profile\n\n This section details how to configure the SCEP Profile\n\n Prerequisites\n\n PKI Connector\n\n SCEP Authority\n\n How to configure SCEP Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access SCEP Profile from the drawer or card: Protocol > SCEP .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon use the name to identify the profile.\n\n Enabled (boolean) :\n\nTells whether the profile is enabled or not. The default value is set to true.\n\n PKI Connector * (select) :\n\nSelect a PKI connector previously created.\n\n Max certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Enabled NDES emulation mode (boolean) :\n\nTells whether the NDES emulation mode is enabled or not. The defaults value is set to false.\n\n DN Whitelist * (boolean) :\n\nTells whether the DN whitelist is enabled or not. The default value is set to false.\n\n SCEP protocol parameters\n\n Mode * (select) :\n\nChoose from the two modes RA or CA.\nThe default value is set to RA.\n\n SCEP Authority * (select) :\n\nSelect a previously created SCEP Authority .\n\n CAPS * (select) :\n\nSelect a caps from the list.\nThe default value is set to SHA.\n\n Encryption algorithm * (select) :\n\nSelect an encryption algorithm from the list.\n\n Password policy (select) :\n\nSelect a previously created password policy. It is used for the challenge generation.\n\n Renewal management\n\n Renewal period ( finite duration ) :\n\nMust be in valid finite duration.\n\n Revocation on SCEP renew? * (boolean) :\n\nThe previous certificate will be revoked on renew if true. The default value is set to false.\n\n Revocation reason * (select) :\n\nSelect the reason from the list. Available only if \"revocation on SCEP renew\" value is set to true.\n\n Self Permissions\n\n Revoke (boolean) :\n\nTells whether self revoke permission is granted or not. The default value is set to false.\n\n Request Revoke (boolean) :\n\nTells whether self request revoke permission is granted or not. The default value is set to false.\n\n Update (boolean) :\n\nTells whether self update permission is granted or not. The default value is set to false.\n\n Request Update (boolean) :\n\nTells whether self request update permission is granted or not. The default value is set to false.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the SCEP Profile.\n\n You won’t be able to delete a SCEP Profile if this one is referenced somewhere else.\n\n EST\n WCCE", - "keywords": [ - "scep", - "admin-guide", - "admin-guide/protocols/scep", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:protocols:wcce", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "WCCE", - "section": "admin-guide", - "slug": "admin-guide/protocols/wcce", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/wcce.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/wcce.html", - "breadcrumbs": ["Horizon", "Admin guide", "Protocols", "WCCE"], - "summary": "WCCE ⚠ Deprecated: This version reached LDOS on 16/05/2025. Introduction This section details how to configure and consume the Windows Client Certificate Enrollment (WCCE) protocol. Managing certificate lifecycle through the WCCE protocol i", - "content": "WCCE\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Introduction\n\n This section details how to configure and consume the Windows Client Certificate Enrollment (WCCE) protocol.\n\n Managing certificate lifecycle through the WCCE protocol involves up to three components:\n\n Active Directory asset (domain controller, server, workstation, user) as WCCE Client;\n\n WinHorizon as the Active Directory enrollment service;\n\n Horizon as the WCCE proxy;\n\nWCCE enrollment modes will be detailed later on.\n\n The protocol paradigm can be described as follows: ' every Windows Active Directory member (machines, users) can use DCOM interfaces to interact with a CA to request certificate enrollment '.\n\n The following schema is a simplified workflow of an WCCE enrollment:\n\nThe protocol is based on the notion of Active Directory membership and configuration.\nActive Directory clients (such as machines and users) having rights on Microsoft Certificate Templates can use Active Directory enrollment service through DCOM interface to request certificate enrollment.\n\n Horizon supports different WCCE enrollment modes:\n\n Entity : Certificate’s elements are built using Active Directory content;\n\n Enrollment On Behalf of Others (EOBO) : Certificate signing request (CSR) is signed by one/many Certificate Enrollment Agent(s);\n\n Trust request : Certificate signature request (CSR) content is fully trust and certificate will be created using its content.\n\nFor Enrollment On Behalf of Others (EOBO) enrollment mode, it is possible to configure a whitelist of Authorized CAs trusted as issuers of enrollment agent certificates.\n\n Windows official resources\n\n EverTrust WCCE implementation is based on official WCCE documentation provided by Microsoft:\n\n MS-WCCE: Windows Client Certificate Enrollment Protocol\n\n Prerequisites\n\n WinHorizon should be installed using WinHorizon installation guide ;\n\n WinHorizon and Active Directory should be configured using WinHorizon administration guide .\n\n WCCE Forest\n\n The first step is to register WCCE Forest on which you want to use WCCE protocol through Horizon.\n\n Uses\n\n MSAD Connector\n\n How to configure WCCE Forest\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE Forest from the drawer or card: Protocol > WCCE > Forest .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Forest Name * (string input) :\nEnter the Active Directory forest name.\n\n 5. Click on the save button.\n\n You can duplicate or delete the WCCE Forest.\n\n You won’t be able to delete an WCCE Forest if it is referenced somewhere else.\n\n WCCE Profile\n\n The second step details how to create and configure a WCCE Horizon profile. This profile is an internal Horizon profile.\n\n Uses\n\n WCCE Template Mapping\n\n WCCE Scheduled Tasks\n\n Prerequisites\n\n PKI\n\n How to configure a WCCE Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE Profile from the drawer or card: Protocol > WCCE > Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of an URL, it is advisable to use only lower case letters and dashes.\n\n Enabled * (boolean) :\n\nIndicates whether the profile is enabled or not. The default value is set to true.\n\n Max certificate per holder (int) :\n\nIf specified, defines the maximum number of active certificates for a given Holder. If the number of active certificates exceeds this parameter, then the oldest certificate(s) above the limit will be automatically revoked.\n\n PKI (select) :\n\nSelect a PKI connector previously created.\n\n Self Permissions\n\n Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to revoke the certificate with no validation workflow. The default value is set to false.\n\n Request Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request the revocation of the certificate. The default value is set to false.\n\n Update (boolean) :\nSpecify whether the certificate’s owner is authorized to update the certificate with no validation workflow. The default value is set to false.\n\n Request Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request certificate’s update. The default value is set to false.\n\n Recover (boolean) :\n\nSpecify whether the certificate’s owner is authorized to recover the certificate with no validation workflow. The default value is set to false.\n\n Request recover (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request certificate’s recover. The default value is set to false.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the WCCE Profile .\n\n You won’t be able to delete a WCCE Profile if this one is referenced somewhere else.\n\n WCCE Template Mapping\n\n The third and last step is to configure mapping between Microsoft Certificate Template configured on Active Directory and Horizon WCCE profile. A mapping is created using a specific enrollment mode.\nAs a result of this mapping, every Microsoft Certificate Template can issue certificate from different PKI (using PKI connector of WCCE profile associated to Microsoft Certificate Template).\n\n Prerequisites\n\n WCCE Forest\n\n WCCE Profile\n\n How to configure WCCE Template Mapping\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE Forest from the drawer or card: Protocol > WCCE > Forest .\n\n 3. Identify the section corresponds to the forest for which you want to add mapping. Click on + button.\n\n 4. Fill the mandatory fields.\n\n Microsoft Template Name * (string input) :\n\nEnter the Microsoft Certificate Template name created on Active Directory side.\n\n Enrollment mode (select) :\n\nSpecify the enrollment mode of this mapping.\n\n EOBO CAs (select) :\n\nSpecify the CA(s) to use for EOBO enrolment.\n\n Profile * (select) :\n\nSelect a previously created WCCE profile.\n\n 5. Click on the save button.\n\n You can edit or delete the WCCE Template mapping.\n\n WCCE test enrollment\n\n This section details how to use the Microsoft Management Console (MMC) to manually retrieve a certificate through WCCE using different enrollment modes.\nIf you want to enroll machine certificate you need to perform the following actions using Administrator Account.\n\n 1. Launch mmc.exe\n\n 2. Click on File > Add/Remove or Remove Snap-ins\n\n 3. On the left panel, click on Certificates then Add\n\nIf you don’t have administrative privileges, the User certificate store will be automatically chosen.\nIf your account has administrative privileges, it will be prompted a window to choose Microsoft Certificate Store to use.\nIf you want to enroll User certificate please chose My user account .\nIf you want to enroll Machine certificate (computer or IIS for example) please chose Computer account .\n\n 4. Navigate to Personal > Certificates\n\n 5. Right click on Windows and chose All tasks > Request certificate\n\n 6. Click on Next\n\n 7. On the next step, let default enrollment policy configuration, then click on Next\n\n The next step lists all Microsoft Certificate Templates on which you have enrollment rights.\nThe Microsoft Certificate template selection and last parts of this testing procedure are specific to the enrollment mode you want to perform.\n\n Please refer to the proper section below.\n\n Requesting a certificate using 'Entity' enrollment mode\n\n 8. Select the Microsoft Certificate Template configured on Horizon side as a part of a Template Mapping using Entity enrollment mode. Click on Next\n\n 9. Click on Enroll to request Enrollment.\n\n 10. Enrollment is requested to WinHorizon. Few seconds later, if enrollment is successful it will be displayed STATUS: Succeeded . Click on Finish .\n\n 11. Your certificate is displayed and available.\n\n Requesting a certificate using 'Enrollment On Behalf of Others' enrollment mode\n\n 8. Identify the Microsoft Certificate Template configured on Horizon side as a part of a Template Mapping using Enrollment On Behalf of Others (EOBO) enrollment mode. Click on Details then Properties .\n\n 9. Navigate to Extensions tab and select Enrollment Agent Certificate (to be used to sign Certificate Request). Click on OK .\n\n 10. Click on Enroll to request Enrollment.\n\n 11. Enrollment is requested to WinHorizon. Few seconds later, if enrollment is successful it will be displayed STATUS: Succeeded . Click on Finish .\n\n 12. Your certificate is displayed and available.\n\n Requesting a certificate using 'Trust request' enrollment mode\n\n 8. Identify the Microsoft Certificate Template configured on Horizon side as a part of a Template Mapping using Trust request enrollment mode. Click on Details then Properties .\n\n 9. Navigate to Subject tab to build your Certificate request manually. Click on OK .\n\n 10. Click on Enroll to request Enrollment.\n\n 11. Enrollment is requested to WinHorizon. Few seconds later, if enrollment is successful it will be displayed STATUS: Succeeded . Click on Finish .\n\n 12. Your certificate is displayed and available.\n\n WCCE MSAD Connector\n\n This section details how to to configure the Microsoft Active Directory Connectors.\n\n Uses\n\n WCCE Scheduled Tasks\n\n Prerequisites\n\n WCCE Forest\n\n How to configure an MSAD Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access MSAD Connectors from the drawer or card: Protocol > WCCE > MSAD Connectors .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (select) :\n\nSelect the Active Directory Forrest you want to use to set up the connector.\n\n Hostname * (string input) :\n\nDNS name or IP of the Active Directory domain.\n\n Port (string input) :\n\nPort to connect to the Active Directory. The default value is set to 636.\n\n Proxy (select) :\n\nSelect a proxy to connect to the Active Directory, if needed.\n\n Bind DN * (string input) :\n\nDN of the Active Directory account. Must have right privileges to browse and list objects.\n\n Password * (string input) :\n\nPassword associated with aforementioned Active Directory DN account.\n\n Timeout * ( finite duration ) :\n\nThe time before Horizon stop trying to connect to Active Directory. Must be in valid finite duration.\n\n Max stored certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Assets identification\n\n Base DN * (string input) :\n\nIt can be the root of your domain or a restriction.\n\n LDAPPUB Filter (string input) :\n\nThis filter must respect LDAPPUB filter syntax.\n\n Actor management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be requested more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nThe default value is set to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nThe default value is set to 3.\n\n 5. Click on the save button.\n\n You can update or delete the MSAD Connector.\n\n You won’t be able to delete a MSAD Connector if this one is referenced somewhere else.\n\n WCCE Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically on your WCCE profiles. You will be able to use MSAD Connector to browse Active Directory and retrieve changes (basically computer removal) to trigger certificate revocation.\nThis mechanism works using comparison between Active Directory content (using MSAD connector) and Horizon certificate list based on a specific WCCE profile.\nIf Horizon has a certificate for a holder that does not exist on Active Directory side a revocation will be triggered automatically.\n\n Prerequisites\n\n WCCE Forest\n\n WCCE Profiles\n\n MSAD Connectors\n\n How to configure WCCE Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE scheduled tasks from the drawer or card: Protocol > WCCE > Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n WCCE Profile * (select) :\n\nSelect the target WCCE profile.\n\n Target Connector * (select) :\n\nSelect the MSAD connector to use as golden source of active Active Directory objects.\n\n Cron scheduling in Quartz format ( cron expression ) :\n\nEnter a Cron scheduling expression (in Quartz format). Default value is every 5 hours.\n\n Revoke (boolean) :\n\nIf true, will revoke all certificate that do not exist on the AD side.\n\n Dry run (boolean) :\n\nIf enabled, revocation actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run , update or delete the Schedules Tasks.\n\n SCEP\n WebRA", - "keywords": [ - "wcce", - "admin-guide", - "admin-guide/protocols/wcce", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:protocols:webra", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "WebRA", - "section": "admin-guide", - "slug": "admin-guide/protocols/webra", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/protocols/webra.html", - "breadcrumbs": ["Horizon", "Admin guide", "Protocols", "WebRA"], - "summary": "WebRA ⚠ Deprecated: This version reached LDOS on 16/05/2025. WebRA Profile This section details how to configure the WebRA Profile. Required By WebRA Scheduled Tasks Prerequisites WebRA Template PKI How to configure WebRA Profile 1. Log in ", - "content": "WebRA\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n WebRA Profile\n\n This section details how to configure the WebRA Profile.\n\n Required By\n\n WebRA Scheduled Tasks\n\n Prerequisites\n\n WebRA Template\n\n PKI\n\n How to configure WebRA Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WebRA Profiles from the drawer or card: Protocols > WebRA > Profiles .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name, this setting will be the profile identifier. It must be unique for each profile.\n\n Enabled (boolean) :\n\nShould the profile be enabled. The default value is set to true.\n\n WebRA Template * (select) :\n\nSelect a previously created WebRA Template.\n\n * PKI * (select) :\n\nSelect a previously created PKI connector.\n\n Max certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Cryptographic Policy\n\n Allowed key type * (select) :\n\nSelect from the list the allowed key types.\nThe default values are set to RSA / 2048 and RSA / 3072.\n\n Decentralized enrollment (boolean) :\n\nTells whether the profile should be used with a decentralized enrollment mode, i.e CSR (PKCS#10) signing by the PKI. The default value is set to false.\n\n Centralized enrollment (boolean) :\n\nTells whether the profile should be used with a centralized enrollment, i.e providing a PKCS#12. The default value is set to false.\n\n Private key escrowing (boolean) :\n\nTells whether the private key should be escrowed by Horizon. Only available if Centralized enrollment is set to true. The default value is set to false.\n\n PKCS#12 Password generation mode * (select) :\n\nDefine if the PKCS#12 password is chosen by the user on the request (manual) or generated randomly (random). Only available if Centralized enrollment is set to true.\n\n Password policy for PKCS#12 password * (select) :\n\nSelect a previously created password policy . Only available if Centralized enrollment is set to true.\n\n Store encryption type (select) :\n\nSelect from the list the encryption type. Only available if Centralized enrollment is set to true. The default value is set to DES_AVERAGE.\n\n Show PKCS#12 Password On Enroll (boolean) :\n\nTells whether the PKCS#12 password should be displayed on enroll. Only available if Centralized enrollment is set to true. The default value is set to false.\n\n Show PKCS#12 On Enroll (boolean) :\n\nTells whether the PKCS#12 should be displayed on enroll. Only available if Centralized enrollment is set to true. The default value is set to false.\n\n Show PKCS#12 Password On Recover (boolean) :\n\nTells whether the PKCS#12 password should be displayed on recover. Enabled when the private key escrowing value is set to on. The default value is set to false.\n\n Show PKCS#12 On Recover (boolean) :\n\nTells whether the PKCS#12 should be displayed on recover. Enabled when the private key escrowing value is set to on. The default value is set to false.\n\n Self Permissions\n\n Revoke (boolean) :\n\nTells whether self revoke permission is granted or not. The default value is set to false.\n\n Request Revoke (boolean) :\n\nTells whether self request revoke permission is granted or not. The default value is set to false.\n\n Update (boolean) :\n\nTells whether self update permission is granted or not. The default value is set to false.\n\n Request Update (boolean) :\n\nTells whether self request update permission is granted or not. The default value is set to false.\n\n Recover (boolean) :\n\nTells whether self recover permission is granted or not. The default value is set to false.\n\n Request recover (boolean) :\n\nTells whether self request recover permission is granted or not. The default value is set to false.\n\n Triggers\n\n WebRA profiles support the use of third-party triggers in the form of callbacks on specific events happening on the profile, giving a way to synchronize the third party repositories and Horizon.\n\n Enrollment (select) :\n\nSelect the third party trigger(s) to call whenever a certificate is enrolled on this profile.\n\n Revocation (select) :\n\nSelect the third party trigger(s) to call whenever a certificate gets revoked on this profile.\n\n Expire (select) :\n\nSelect the third party trigger(s) to call whenever a certificate expires on this profile.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the WebRA Profile.\n\n You won’t be able to delete a WebRA Profile if it is referenced somewhere else.\n\n WebRA Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically with your WebRA profiles.\n\n Prerequisites\n\n AWS Connector\n\n AKV Connector\n\n F5 Connector\n\n WebRA Profile\n\n How to configure WebRA Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access the \"Scheduled tasks\" from the drawer or card: Protocols > WebRA > Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n WebRA Profile * (select) :\n\nSelect a previously created WebRA profile.\n\n Target Connector * (select) :\n\nSelect a previously created third party connector.\n\n Cron scheduling ( cron expression ) :\n\nEnter a Cron scheduling expression (in Quartz format). The default expression is built to run the task every 5 hours.\n\n Revoke (boolean) :\n\nIf enabled, will revoke all certificate whose container was deleted from the third party repository.\nThe default value is set to false.\n\n Renew (boolean) :\n\nIf enabled, will renew all certificate who are about to expire. The default value is set to false.\n\n Dry run (boolean) :\n\nIf enabled, revocation and renewal actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run or edit or delete the Schedules Tasks.\n\n WebRA Template\n\n This section details how to define a custom structure for the fields subject DN & SAN of the requested certificate in order to match the configuration on the PKI side.\n\n How to configure WebRA Template\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WebRA Templates from the drawer or card: Protocols > WebRA > Templates .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Details\n\n Template Name * (string input) :\nEnter a meaningful WebRA template name. It must be unique for each template.\n\n Subject DN composition\n\n You can add more elements by clicking the add button.\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Regex (string input) :\n\nEnter a regular expression that the element should match.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n You can remove an element by clicking the delete button .\n\n SAN composition\n\n You can add more elements by clicking the add button.\n\n Element * (select) :\n\nSelect an attribute from the element list.\n\n Mandatory (boolean) :\n\nTells whether the element should be mandatory. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Regex (string input) :\n\nEnter a regular expression that the element should match.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver [.mysize]_(boolean)_s:\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n You can remove an element by clicking the delete button .\n\nWhen adding a SAN or a DN element and making it mandatory, make sure to either give it a default value or make it editable by the requester, otherwise the template will be unusable.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the WebRA template.\n\n You won’t be able to delete WebRA template if it is referenced somewhere else.\n\n WCCE\n Common configuration elements for profiles", - "keywords": [ - "webra", - "admin-guide", - "admin-guide/protocols/webra", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:reports", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Reports", - "section": "admin-guide", - "slug": "admin-guide/reports", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/reports.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/reports.html", - "breadcrumbs": ["Horizon", "Admin guide", "Reports"], - "summary": "Reports ⚠ Deprecated: This version reached LDOS on 16/05/2025. A report is a CSV file sent in a scheduled mail. The CSV content is managed by: HCQL query (certificates), HRQL query (requests) CSV fields shown Prerequisites You may need Team", - "content": "Reports\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n A report is a CSV file sent in a scheduled mail. The CSV content is managed by:\n\n HCQL query (certificates), HRQL query (requests)\n\n CSV fields shown\n\n Prerequisites\n\n You may need Teams .\n\n How to configure Reports\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Reports from the drawer or card: Reports .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Details\n\n Enabled (boolean) :\n\nTells whether the reporting task should be enabled. Set by default at true.\n\n Name * (string input) :\n\nEnter a meaningful report name. It must be unique.\n\n Cron scheduling expression in Quartz format * ( cron expression ) :\n\nEnter a Cron scheduling expression (in Quartz format). The default expression is built to run the task every hour.\n\n Recipients\n\n Click on to add a recipient.\n\n You can either target :\n\n A static (recipient): you will need to set a valid email address.\n\n A team contact: you will need to select one of the enabled teams.\n\n A team manager: you will need to select one of the enabled teams.\n\n Email\n\n From * (string input) :\n\nEnter the email address that will appear in the \"From\" field of the email.\n\n Subject * (string input) :\n\nEnter the subject of the email.\n\n Body (string input) :\n\nEnter the body of the email.\n\n CSV file name (string input) :\n\nEnter the name that will be given to the attached csv file.\n\n Is HTML (boolean) : (boolean):\n\nSets whether the email body contains HTML code (true) or plain text (false). The default value is set to false.\n\n HQL\n\n HQL Type * (select) :\n\nEither chose Certificate or Request. It will define the HQL Query type to set and the enabled CSV fields.\n\n Query (string input or select) :\n\nHCQL (Certificate) or HRQL (Request). You can select one of your saved queries.\n\n CSV\n\n You can select which fields will appear on the CSV file.\n\n 5. Click on the save button.\n\n You can run , edit or delete the report .\n\n Finite Duration\n Syslog Integration", - "keywords": [ - "reports", - "admin-guide", - "admin-guide/reports", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:security:accounts", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Local Accounts", - "section": "admin-guide", - "slug": "admin-guide/security/accounts", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/security/accounts.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/accounts.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Local Accounts"], - "summary": "Local Accounts ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure the EverTrust Horizon local accounts and set their password. Local accounts are useful to create technical accounts, such as require", - "content": "Local Accounts\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure the EverTrust Horizon local accounts and set their password.\n\n Local accounts are useful to create technical accounts, such as required by horizon-cli for some scenarios (e.g. Scan/Discovery)\n\n How to create local accounts\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Local accounts from the drawer or card: Security > Access Management > Local Accounts .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Identifier * (string input) :\n\nEnter a meaningful identifier for the account holder. It will be used as a login to access to the solution.\n\n Name (string input) :\n\nEnter a meaningful name for the account holder.\n\n Email (string input) :\n\nEnter the account holder email.\n\n 5. Click on the save button.\n\n How to set a password to a local account\n\n 1. Once a local account is created. Click on .\n\n 2. Fill in the mandatory fields.\n\n Password * (string input) :\n\nSet a password.\n\n Confirm password * (string input) :\n\nConfirm the password.\n\n 3. Click on the save button.\n\n You can edit or delete a local account. You can manage a local account password.\n\n You can not delete yourself from local accounts.\n\n Sectigo CMS\n Authorization", - "keywords": [ - "local", - "accounts", - "admin-guide", - "admin-guide/security/accounts", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:security:authorization", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Authorization", - "section": "admin-guide", - "slug": "admin-guide/security/authorization", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/security/authorization.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/authorization.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Authorization"], - "summary": "Authorization ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure the permissions granted to an account, either directly or through a configured role. Prerequisites According to the context, you migh", - "content": "Authorization\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure the permissions granted to an account, either directly or through a configured role.\n\n Prerequisites\n\n According to the context, you might need to set up:\n\n Roles\n\n Local accounts\n\n How to add an authorization manually or from a certificate\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Authorizations from the drawer or card: Security > Access Management > Authorizations .\n\n 3. Click on .\n\n 4. Click on Add Authorization Manually\n\n 5. Fill the mandatory fields.\n\n Either:\n\n Fill in an Identifier * (string input or import) :\n\nEnter a meaningful identifier. It can be either a local account identifier or an OpenID Connect identifier (usually email address).\n\n Import a certificate by clicking on certificate button .\n\n Contact email (string input) :\n\nEnter the contact email for the account.\n\n 6 . Click on add button.\n\n How to add an authorization from a search\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Authorizations from the drawer or card: Security > Access Management > Authorizations .\n\n 3. Click on .\n\n 4. Click on Search and Add Authorization\n\n 5. Fill one of the fields.\n\n Identifier * (string input) :\n\nEnter the identifier of the account to look for.\n\n Email * (string input) :\n\nEnter the email of the account to look for.\n\n 6 . Click on search button.\n\n 7 . Choose the identifier you want to add.\n\n 8 . Click on add button.\n\n You can update or delete Authorization.\n\n How to grant a permission\n\n 1. Click on .\n\n Role\n\n 2. Select a role previously created (if needed).\n\n Team\n\n 3. Select a team previously created (if needed).\n\n Configuration\n\n You can build here a configuration permission. The permission follows the pattern: Section / Module / Right.\n\n 4. Click on add button.\n\n 5. Select a section, then a module, then a submodule if there is, and a right.\n\n 6. Click on add button (Don’t forget to save).\n\n 7. Click on the save button if you are done.\n\n Lifecycle\n\n You can build here a lifecycle permission. The permission follows the pattern: Module / Profile / Right. You can further restrict the permission by adding a filter from the \"Horizon Permission Query Language\".\n\n 4. Click on add button.\n\n 5. Select a module, then a profile, and a right.\n\n 6. Click on add button. (don’t forget to save).\n\n 7. Click on the save button if you are done.\n\n Horizon requests lifecycle:\n\n Discovery\n\n You can build here a discovery permission. The permission follows the pattern: Module / Discovery campaign name / Right.\n\n 4. Click on add button.\n\n 5. Select a module, then a campaign, and a right.\n\n 6. Click on add button. (don’t forget to save)\n\n 7. Click on the save button if you are done.\n\n Local Accounts\n Roles", - "keywords": [ - "authorization", - "admin-guide", - "admin-guide/security/authorization", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:security:policies", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Password Policies", - "section": "admin-guide", - "slug": "admin-guide/security/policies", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/security/policies.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/policies.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Security", - "Password Policies" - ], - "summary": "Password Policies ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure password policies that will be used by Horizon. How to configure a Password Policy 1. Log in to Horizon Administration Interface.", - "content": "Password Policies\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure password policies that will be used by Horizon.\n\n How to configure a Password Policy\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Password Policies from the drawer or card: Security > Password Policies .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Name *:\n\nEnter a meaningful password policy name;\n\n Password range length * (int) :\n\nPassword length (0 is unlimited);\n\n Minimum of lowercase (int) :\n\nMinimum of lowercase characters in the password;\n\n Minimum of uppercase (int) :\n\nMinimum of uppercase characters in the password;\n\n Minimum of digit (int) :\n\nMinimum of digit in the password;\n\n Minimum of special character (int) :\n\nMinimum of special characters in the password;\n\n Special characters accepted (string input) :\n\nWhitelist of special characters accepted in the password.\n\n 5. Click on the save button.\n\n You can update or delete the Password Policy.\n\n You won’t be able to delete a Password Policy if it is referenced in any other configuration element.\n\n Roles\n Identity Providers Configuration", - "keywords": [ - "password", - "policies", - "admin-guide", - "admin-guide/security/policies", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:security:providers", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Identity Providers Configuration", - "section": "admin-guide", - "slug": "admin-guide/security/providers", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/security/providers.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/providers.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Security", - "Identity Providers Configuration" - ], - "summary": "Identity Providers Configuration ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure Identity Providers. Identity Providers are going to be used by Horizon to verify the identity of an end-user based", - "content": "Identity Providers Configuration\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure Identity Providers.\nIdentity Providers are going to be used by Horizon to verify the identity of an end-user based on the authentication performed by an external authorization server.\n\n How to configure an Identity Provider\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Identity Providers from the drawer or card: Security > Access Management > Identity Providers .\n\n 3. Click on .\n\n General tab\n\n 4. Select an identity provider type. Currently only OpenID is supported\n\n OpenID connect\n\n 5. Fill in all mandatory fields:\n\n Name * (string input) :\n\nEnter a meaningful identity provider name.\n\n Provider metadata URL * (string input) :\n\nEnter the OpenID Connect provider metadata URL.\n\n Client ID * (string input) :\n\nIdentifier generated on the OpenID Connect IDP when setting up a new application (Horizon) to authenticate users on the identity provider.\n\n Client Secret * (string input) :\n\nPassword associated to the aforementioned identifier (Client ID);\n\n Scope * (string input) :\n\nScope used by Horizon during authentication on the identity provider to authorize access to user’s details.\n\n Proxy (string input) :\n\nProxy used to access Provider metadata URL, if any.\n\n Timeout ( finite duration ) :\n\nTimeout used for authentication on the identity provider. Must be a valid finite duration. By default 10 seconds.\n\n Identifier Claim * (string input) :\n\nDynamic expression defining how to construct the identifier from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user identifier is contained in the login claim, then the configured value should be {{login}} .\n\n Email Claim * (string input) :\n\nDynamic expression defining how to construct the user email from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user email is contained in the 'email' claim, then the configured value should be {{email}} . If the email is not available directly from the claims but can be computed from the 'login' claim by appending a domain, the configured value should be {{login}}@evertrust.fr .\n\n Name Claim * (string input) :\n\nDynamic expression defining how to construct the username from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user name must be constructed as family name, given name and family name is available in the family_name claim, given name is available in the given_name claim, then the configured value should be {{family_name}}, {{given_name}} .\n\n Enabled * (boolean) :\n\nEnable/Disable the identity provider.\n\n Enabled on UI * (boolean) :\n\nEnable/Disable the identity provider on user interface.\n\n Languages tab\n\n *\n* Language : Please refer to Languages section to set up localized Identity Provider display name and description.\n\n 6. Click on the save button.\n\n You can update or delete the Identity Provider.\n\n You won’t be able to delete an Identity Provider if it is referenced in any other configuration element.\n\n Password Policies\n Teams", - "keywords": [ - "identity", - "providers", - "configuration", - "admin-guide", - "admin-guide/security/providers", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:security:roles", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Roles", - "section": "admin-guide", - "slug": "admin-guide/security/roles", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/security/roles.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/roles.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Roles"], - "summary": "Roles ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure the roles. Roles are groups of permissions that can be configured for authorizations. How to create a role 1. Log in to Horizon Administratio", - "content": "Roles\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure the roles. Roles are groups of permissions that can be configured for authorizations.\n\n How to create a role\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Roles from the drawer or card: Security > Access Management > Roles .\n\n 3. Click on .\n\n 4. Fill in at least the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful name.\n\n Description (string input) :\n\nEnter a description.\n\n 6. configuration permissions\n\n 7. lifecycle permissions\n\n 8. discovery permissions\n\n 9. Click on the save button.\n\n You can get the list of members .\n\n You can update or delete the Role.\n\n Authorization\n Password Policies", - "keywords": [ - "roles", - "admin-guide", - "admin-guide/security/roles", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:security:teams", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Teams", - "section": "admin-guide", - "slug": "admin-guide/security/teams", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/security/teams.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/teams.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Teams"], - "summary": "Teams ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure teams. Teams are groups of horizon objects owner (certificates, requests) and does not define permissions. How to create a team 1. Log in to ", - "content": "Teams\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure teams. Teams are groups of horizon objects owner (certificates, requests) and does not define permissions.\n\n How to create a team\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Teams from the drawer or card: Security > Access Management > Teams .\n\n 3. Click on .\n\n 4. Fill at least the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful name.\n\n Description (string input) :\n\nEnter a description.\n\n Contact email (string input) :\n\nEnter a valid mail.\n\n Manager email (string input) :\n\nEnter a valid mail.\n\n Messaging tool (select) :\n\nSelect one of Webhook Messaging tools supported\n\n URL (string input) :\n\nEnter the webhook messaging URL for the team(used by Messaging notification )\n\n 5. Click on the save button.\n\n You can get the list of members .\n\n You can update or delete the Team.\n\n Identity Providers Configuration\n Notifications", - "keywords": [ - "teams", - "admin-guide", - "admin-guide/security/teams", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:syslog", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Syslog Integration", - "section": "admin-guide", - "slug": "admin-guide/syslog", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/syslog.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/syslog.html", - "breadcrumbs": ["Horizon", "Admin guide", "Syslog Integration"], - "summary": "Syslog Integration ⚠ Deprecated: This version reached LDOS on 16/05/2025. Horizon is able to push its events (functional logs) to a syslog instance. This integration is pretty straightforward and can be implemented 2 ways : Directly sending", - "content": "Syslog Integration\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Horizon is able to push its events (functional logs) to a syslog instance.\nThis integration is pretty straightforward and can be implemented 2 ways :\n\n Directly sending logs to your syslog server\n\n 1. Access the EverTrust Horizon server through SSH with an account with administrative privileges;\n\n 2. Using an editor like vi, open the horizon-logback.xml file located at /opt/horizon/etc/horizon-logback.xml ;\n\n 3. Edit the appender named \"SYSLOG\" to change the IP address for the syslogHost to redirect to your own syslog server.\nAs an example, if your syslog server is on 192.168.1.2 and the Horizon logs must be processed by the LOCAL6 facility, the syslog appender should look like this :\n\n <appender name=\"SYSLOG\" class=\"ch.qos.logback.classic.net.SyslogAppender\">\n <syslogHost>192.168.1.2</syslogHost>\n <facility>LOCAL6</facility>\n <suffixPattern>%msg%n</suffixPattern>\n</appender>\n\n 4. Still in the horizon-logback.xml file, update the syslog logger and ensure that the log level is set to \"INFO\":\n\n <logger name=\"syslog\" level=\"INFO\">\n <appender-ref ref=\"SYSLOG\"/>\n</logger>\n\n 5. Save your modifications and restart the Horizon service :\n\n $ systemctl restart horizon\n\n The functional logs from Horizon should now be received by your remote syslog server :\n\n horizon {\"code\": \"SERVICE-STOP\",\"details\":[{\"key\":\"horizonVersion\",\"value\":\"2.3.4\"},{\"key\":\"message\",\"value\":\"Service successfully stopped\"}],\"module\":\"service\",\"node\":\"horizon\",\"timestamp\":1674054152149,\"status\":\"success\"}\nhorizon {\"code\": \"SERVICE-START\",\"details\":[{\"key\":\"horizonVersion\",\"value\":\"2.3.4\"},{\"key\":\"message\",\"value\":\"Service successfully started\"}],\"module\":\"service\",\"node\":\"horizon\",\"timestamp\":1674054170567,\"status\":\"success\"}\n\n Using the local syslog server for filtering and forwarding\n\n Alternatively, you might want to use a local syslog instance to add grok filtering to your logs before forwarding them to your own syslog server.\nTo do so, ensure that you have a syslog instance running (like rsyslog ), then :\n\n 1. Access the EverTrust Horizon server through SSH with an account with administrative privileges;\n\n 2. With an editor like vi, edit the /etc/rsyslog.d/horizon.conf (or create it if it does not exist yet) to add this line :\n\n local6.* @REMOTE_SYSLOG_HOSTNAME\n\n Don’t forget to replace the REMOTE_SYSLOG_HOSTNAME to the IP or DNS name of your remote syslog server. As an example, if your syslog server is on 192.168.1.2, the line should look like this :\n\n local6.* @192.168.1.2\n\n Note that you must set up your syslog host to accept UDP traffic on a specific port (here, we are going to use the default port which is 514) and catch the local6 facility logs, however the configuration of your own syslog host is out of the scope of this document.\n\n 3. Edit the /etc/rsyslog.conf file to uncomment the module and input lines of the UDP section :\n\n #module(load=\"imudp\") # needs to be done just once\n#input(type=\"imudp\" port=\"514\")\n\n They should look like this after uncommenting :\n\n module(load=\"imudp\") # needs to be done just once\ninput(type=\"imudp\" port=\"514\")\n\n 4. Restart your syslog service :\n\n $ systemctl restart rsyslog\n\n The functional logs from Horizon should now be received by your remote syslog server, and you can add filtering on the /etc/rsyslog.d/horizon.conf file before the logs actually get forwarded :\n\n horizon {\"code\": \"SERVICE-STOP\",\"details\":[{\"key\":\"horizonVersion\",\"value\":\"2.3.4\"},{\"key\":\"message\",\"value\":\"Service successfully stopped\"}],\"module\":\"service\",\"node\":\"horizon\",\"timestamp\":1674056069695,\"status\":\"success\"}\nhorizon {\"code\": \"SERVICE-START\",\"details\":[{\"key\":\"horizonVersion\",\"value\":\"2.3.4\"},{\"key\":\"message\",\"value\":\"Service successfully started\"}],\"module\":\"service\",\"node\":\"horizon\",\"timestamp\":1674056087880,\"status\":\"success\"}\n\n Reports\n Introduction", - "keywords": [ - "syslog", - "integration", - "admin-guide", - "admin-guide/syslog", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:system:http_proxies", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "HTTP Proxy", - "section": "admin-guide", - "slug": "admin-guide/system/http_proxies", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/system/http_proxies.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/system/http_proxies.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "System configuration", - "HTTP Proxy" - ], - "summary": "HTTP Proxy ⚠ Deprecated: This version reached LDOS on 16/05/2025. In this section you will be able to set up HTTP Proxies. HTTP Proxies may be used by Horizon to establish connection to various services. How to configure an HTTP Proxy 1. Lo", - "content": "HTTP Proxy\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n In this section you will be able to set up HTTP Proxies. HTTP Proxies may be used by Horizon to establish connection to various services.\n\n How to configure an HTTP Proxy\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access HTTP Proxy from the drawer or card: System > HTTP Proxies .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful HTTP Proxy name.\n\n Host * (string input) :\n\nThe Hostname or IP Address of the HTTP/HTTPS proxy to use.\n\n Port * (int) :\n\nThe Port of the HTTP/HTTPS proxy to use.\n\n 5. Click on the create button to save.\n\n You can update or delete the HTTP Proxy.\n\n You won’t be able to delete an HTTP Proxy if it is referenced in any other configuration element.\n\n Labels\n Cron Expression", - "keywords": [ - "http", - "proxy", - "admin-guide", - "admin-guide/system/http_proxies", - "horizon", - "admin", - "guide", - "system", - "configuration" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:system:labels", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Labels", - "section": "admin-guide", - "slug": "admin-guide/system/labels", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/system/labels.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/system/labels.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "System configuration", - "Labels" - ], - "summary": "Labels ⚠ Deprecated: This version reached LDOS on 16/05/2025. You will be able to associate the labels created in this section with your profiles in order to enrich the certificates that will be issued from them. How to configure a Label 1.", - "content": "Labels\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n You will be able to associate the labels created in this section with your profiles in order to enrich the certificates that will be issued from them.\n\n How to configure a Label\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Labels from the drawer or card: System > Labels .\n\n 3. Click on .\n\n 4. Fill the following fields:\n\n Name * (string input) :\n\nEnter a meaningful Label name.\n\n Language * (select) :\n\nPlease refer to Languages section to set up localized Label display name and description.\n\n Display name (string input) :\n\nThe name that will be displayed for this label in the selected language. Optional.\n\n Description (string input) :\n\nThe description of this label in the selected language. Optional.\n\n 5. Click on the create button to save.\n\n You can update or delete Labels.\n\n You won’t be able to delete a Label if it is referenced in any other configuration element.\n\n SCEP Authorities\n HTTP Proxy", - "keywords": [ - "labels", - "admin-guide", - "admin-guide/system/labels", - "horizon", - "admin", - "guide", - "system", - "configuration" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:system:scep_authorities", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "SCEP Authorities", - "section": "admin-guide", - "slug": "admin-guide/system/scep_authorities", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/system/scep_authorities.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.5/admin-guide/system/scep_authorities.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "System configuration", - "SCEP Authorities" - ], - "summary": "SCEP Authorities ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure SCEP Authorities. The draft-nourse-scep-23 as well as RFC 8894 define how SCEP communications are secured. This involves using a S", - "content": "SCEP Authorities\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure SCEP Authorities.\n\n The draft-nourse-scep-23 as well as RFC 8894 define how SCEP communications are secured. This involves using a SCEP Authority, which is a certificate and its associated private key, used to sign and encrypt communications between SCEP server and client.\n\n Two setups are possible:\n\n the CA mode in which the SCEP Authority is a self-signed certificate. In that mode the SCEP server returns the self-signed certificate as application/x-x509-ca-cert when the client uses the GetCaCert call.\n\n the RA mode in which the SCEP Authority is a certificate signed by the CA that will issue certificates using the considered SCEP profile. In that mode, the SCEP server returns the SCEP Authority certificate and its issuing CA chain as application/x-x509-ca-ra-cert when the client uses the GetCaCert call.\n\n Therefore, it is important in each SCEP or MDM Profile to align the SCEP mode with the characteristics of the SCEP Authority configured in the current section.\n\n Prerequisites\n\n PKCS#12 containing the SCEP Authority certificate and private key. See above for explanation about the SCEP contents.\n\n How to configure a SCEP Authority\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access SCEP Authorities from the drawer or card: System > SCEP Authorities .\n\n 3. Click on .\n\n 4. Fill the following fields:\n\n Name * (string input) :\n\nEnter a meaningful SCEP Authority name;\n\n PKCS#12 * (import p12) :\n\nPKCS#12 of the SCEP Authority;\n\n PKCS#12 Password * (string input) :\n\nPassword of the aforementioned PKCS#12.\n\n 5. Click on the create button to save.\n\n You can update or delete the SCEP Authority.\n\n You won’t be able to delete a SCEP Authority if it is referenced in any other configuration element.\n\n LDAP\n Labels", - "keywords": [ - "scep", - "authorities", - "admin-guide", - "admin-guide/system/scep_authorities", - "horizon", - "admin", - "guide", - "system", - "configuration" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:third-parties:akv", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Azure Key Vault Integration", - "section": "admin-guide", - "slug": "admin-guide/third-parties/akv", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/akv.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/akv.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "Azure Key Vault Integration" - ], - "summary": "Azure Key Vault Integration ⚠ Deprecated: This version reached LDOS on 16/05/2025. Introduction This section refers to the Azure Key Vault (AKV) integration with Horizon, used to enroll certificates held in AKV. This integration involves at", - "content": "Azure Key Vault Integration\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Introduction\n\n This section refers to the Azure Key Vault (AKV) integration with Horizon, used to enroll certificates held in AKV.\n\n This integration involves at least three infrastructure components:\n\n Azure Key Vault\n\n Azure Active Directory\n\n EverTrust Horizon\n\n Azure AD is used to authenticate Horizon, which should be a registered application.\n\n Azure AKV Connector\n\n Here is the section to manage the Azure AKV Connector.\n\n Required By\n\n AKV Trigger\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy used to reach Azure, if necessary.\n\n On Azure AD side, it is required to set up an application by following Microsoft’s guide .\n\n Horizon supports only client secret authentication\n\n After performing these steps, you will get the following information, required later:\n\n the Tenant ID\n\n the Application ID\n\n the Application Authentication Key\n\n Finally, you should give all Certificate Permissions to the Application you created for Horizon inside the target Azure Key Vault \"Access policies\" menu entry, using the \"Add Access Policy\" link.\n\n How to configure AKV Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AKV Connectors from the drawer or card: Third Parties > AKV > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful Connector Name.\n\n Azure Tenant * (string input) :\n\nEnter the Tenant, which is the domain name after the @ sign in your account.\n\n App ID * (string input) :\n\nEnter the app ID.\n\n App Key * (string input) :\n\nEnter the app Key.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy used to reach Azure AD and AKV, if necessary.\n\n Timeout ( finite duration ) :\n\nSet on the connections used to reach Azure AD and AKV. Configured by default at 10 seconds. Must be in valid finite duration.\n\n Vault fully qualified domain name * (string input) :\n\nFully qualified domain name used to reach the Azure Key Vault to be managed by Horizon.\n\n Assets identification and management\n\n Prefix (string input) : Used to filter the certificates managed by Horizon in the specified Azure Key Vault. Defaults to \"HRZ-\"\n\n Actors and renewal management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be in valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default at 3.\n\n Renewal period ( finite duration ) :\n\nMust be a valid finite duration.\n\n 5. Click on the save button.\n\n You can update or delete the AKV Connector.\n\n You will not be able to delete an AKV Connector if it is referenced in any other configuration element.\n\n AKV Trigger\n\n This section details how to configure the Triggers that will be used by WebRA Profiles to push or delete certificates to/from AKV.\n\n Prerequisites\n\n AKV Connector\n\n How to configure AKV Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AKV Triggers from the drawer or card: Third Parties > AKV > Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n Azure Key Vault Connector * (select) :\n\nSelect an AKV connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the AKV repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the AKV Trigger.\n\n Integration of the third party to the WebRA\n\n When having configured the connector, it is possible to automate its elements' lifecycle using the WebRA.\n\n Automation using triggers\n\n Triggers are a functionality of WebRA that allows to push lifecycle events into a third party whenever they occur on a WebRA profile.\n\n 1. Refer to the trigger documentation to create a trigger.\n\n 2. Create or modify the WebRA profile you wish to use the triggers on.\n\n 3. Go to the Triggers tab, then on Certificate lifecycle triggers\n\n 4. Chose which lifecycle events you wish to use triggers upon (enrollment, revocation, expiration)\n\n 5. Select one or more existing triggers from the menu (if several are selected, they will all be called whenever the selected event occurs)\n\n 6. Click on the Save button.\n\n From now on, whenever a selected lifecycle event will occur on the configured WebRA profile, the trigger will be called and the and the certificate will be pushed into or removed from the third party container.\n\n Automation using scheduled tasks\n\n Scheduled tasks are a functionality of WebRA that allows to synchronize automatic renewal or revocation events with a third party periodically with what occurs on a WebRA profile.\nTo be more specific, it will periodically check whether the certificate has entered the \"renewal period\" that was defined in the connector’s configuration, and renew it automatically if necessary.\n\n 1. Refer to the third party connector documentation to create a third party connector.\n\n 2. Ensure you have an existing WebRA profile : renewal will be automated on the selected profile.\n\n 3. Follow the documentation of the WebRA scheduled tasks section to properly configure a scheduled task.\n\n AWS Certificate Manager Integration\n F5 BigIP Integration", - "keywords": [ - "azure", - "key", - "vault", - "integration", - "admin-guide", - "admin-guide/third-parties/akv", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:third-parties:aws", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "AWS Certificate Manager Integration", - "section": "admin-guide", - "slug": "admin-guide/third-parties/aws", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/aws.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/aws.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "AWS Certificate Manager Integration" - ], - "summary": "AWS Certificate Manager Integration ⚠ Deprecated: This version reached LDOS on 16/05/2025. Introduction This section refers to the AWS Certificate Manager (ACM) integration with Horizon, used to enroll certificates held in ACM. This integra", - "content": "AWS Certificate Manager Integration\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Introduction\n\n This section refers to the AWS Certificate Manager (ACM) integration with Horizon, used to enroll certificates held in ACM.\n\n This integration involves at least two infrastructure components:\n\n AWS Certificate Manager\n\n EverTrust Horizon\n\n AWS Connector\n\n Here is the section to manage the AWS Connector.\n\n Required By\n\n AWS Trigger\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy , used to reach AWS, if necessary.\n\n On AWS side, you need to create a user using the AWS IAM module, and following AWS guide . You should create an access key for that user, and give him appropriate permissions. The created user should hold the following permissions:\n\n AWSResourceGroupsReadOnlyAccess\n\n ResourceGroupsandTagEditorReadOnlyAccess\n\n AWSCertificateManagerFullAccess\n\n After performing these steps, you will get the following information, required later:\n\n the AWS Region\n\n the User Access Key ID\n\n the User Access Key Secret\n\n On top of that, you need to define a Resource Group, using AWS Resource Groups and Tags Editor, with the following characteristics:\n\n Group Type: Tag based\n\n Resource Type: AWS::CertificateManager::Certificate\n\n Tag key and value (e.g. key=manage and value=HRZ)\n\n After performing this steps, you will get the following information, required later:\n\n The Resource Group name\n\n the Tag name\n\n the Tag value\n\n How to configure AWS Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AWS Connectors from the drawer or card: Third Parties > AWS > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Region * (string input) :\n\nEnter a valid AWS region. Here’s the region list from AWS.\n\n Access key ID (string input) :\n\nUser Access Key ID used by Horizon to connect to AWS.\n\n Access Key Secret (string input) :\n\nAccess Key Secret associated to the aforementioned User Access Key ID.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy to use to reach AWS, if any.\n\n Timeout * ( finite duration ) :\n\nThe timeout for Horizon-initiated connections to AWS. Must be a valid finite duration.\n\n Assets identification\n\n Resource group name (string input) :\n\nName of the resource group pointing to the tag name and value.\n\n Tag key (string input) :\n\nName of the tag used to identify certificates managed by Horizon in ACM.\n\n Tag value (string input) :\n\nValue of the tag used to identify certificates managed by Horizon in ACM.\n\n Actors and renewal management\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be in valid finite duration.\n\n Renewal period ( finite duration ) :\n\nCertificate renewal period (time before expiration to trigger renewal). Must be in valid finite duration.\n\n 5. Click on the save button.\n\n You can update or delete the AWS Connector.\n\n You won’t be able to delete an AWS Connector if it is referenced somewhere else.\n\n AWS Trigger\n\n Here is the section to manage the Triggers that will be used by WebRA Profiles to push or delete certificates to/from AWS ACM.\n\n Prerequisites\n\n AWS Connector\n\n How to configure AWS Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AWS Triggers from the drawer or card: Third Parties > AWS > Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n AWS Connector * (select) :\n\nSelect an AWS connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the AWS repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the AWS Trigger.\n\n You won’t be able to delete an AWS Trigger if it is referenced somewhere else.\n\n Integration of the third party to the WebRA\n\n When having configured the connector, it is possible to automate its elements' lifecycle using the WebRA.\n\n Automation using triggers\n\n Triggers are a functionality of WebRA that allows to push lifecycle events into a third party whenever they occur on a WebRA profile.\n\n 1. Refer to the trigger documentation to create a trigger.\n\n 2. Create or modify the WebRA profile you wish to use the triggers on.\n\n 3. Go to the Triggers tab, then on Certificate lifecycle triggers\n\n 4. Chose which lifecycle events you wish to use triggers upon (enrollment, revocation, expiration)\n\n 5. Select one or more existing triggers from the menu (if several are selected, they will all be called whenever the selected event occurs)\n\n 6. Click on the Save button.\n\n From now on, whenever a selected lifecycle event will occur on the configured WebRA profile, the trigger will be called and the and the certificate will be pushed into or removed from the third party container.\n\n Automation using scheduled tasks\n\n Scheduled tasks are a functionality of WebRA that allows to synchronize automatic renewal or revocation events with a third party periodically with what occurs on a WebRA profile.\nTo be more specific, it will periodically check whether the certificate has entered the \"renewal period\" that was defined in the connector’s configuration, and renew it automatically if necessary.\n\n 1. Refer to the third party connector documentation to create a third party connector.\n\n 2. Ensure you have an existing WebRA profile : renewal will be automated on the selected profile.\n\n 3. Follow the documentation of the WebRA scheduled tasks section to properly configure a scheduled task.\n\n Common configuration elements for profiles\n Azure Key Vault Integration", - "keywords": [ - "aws", - "certificate", - "manager", - "integration", - "admin-guide", - "admin-guide/third-parties/aws", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:third-parties:f5", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "F5 BigIP Integration", - "section": "admin-guide", - "slug": "admin-guide/third-parties/f5", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/f5.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/f5.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "F5 BigIP Integration" - ], - "summary": "F5 BigIP Integration ⚠ Deprecated: This version reached LDOS on 16/05/2025. Introduction This section refers to the F5 BigIP integration with Horizon, used to enroll certificates used by F5 BigIP. This integration involves at least two infr", - "content": "F5 BigIP Integration\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Introduction\n\n This section refers to the F5 BigIP integration with Horizon, used to enroll certificates used by F5 BigIP.\n\n This integration involves at least two infrastructure components:\n\n F5 BigIP\n\n EverTrust Horizon\n\n Horizon connects to the F5 BigIP using the iControl REST administration API in order to manage the lifecycle of certificates associated to Client SSL Profiles within the BigIP.\n\n F5 Connector\n\n This section details how to configure the F5 Connector.\n\n Prerequisites\n\n On the F5 BigIP side, you need to create a technical user for Horizon, and give it full administrator rights. This is required because only full admins have the right to upload certificates on an F5 BigIP.\n\n After performing these steps, you will get the following information, required later:\n\n the technical user login/username\n\n the technical user password\n\n How to configure F5 Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access F5 Connectors from the drawer or card: Third Parties > F5 > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n F5 BigIP hostname * (string input) :\n\nEnter the F5 BigIP hostname (DNS or IP address).\n\n F5 BigIP username * (string input) :\n\nUsername created for Horizon in the F5 BigIP. Must have administrator rights.\n\n F5 BigIP password * (string input) :\n\nPassword associated with aforementioned username.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy to use.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be a valid finite duration*.\n\n Max stored certificates per holder (int) :\n\nWhen specified, define the maximum number of certificates stored in the third party for a given holder.\n\n Assets identification\n\n Partition (string input) :\n\nF5 BigIP partition to manage. Common by default.\n\n SSL parent (string input) :\n\nName of the parent Client SSL Profile. Common by default.\n\n Prefix (string input) :\n\nUsed to filter the certificates managed by Horizon in the specified F5 Client. hrz- by default.\n\n Cipher group (string input) :\n\nName of the Cipher group. None by default.\n\n Actors and renewal management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be in valid finite duration*.\n\n Throttle parallelism * (int) :\n\nSet by default at 3.\n\n Renewal period * ( finite duration ) :\n\nMust be a valid finite duration*.\n\n 5. Click on the save button.\n\n You can update or delete the F5 Connector.\n\n You will not be able to delete an F5 Connector if it is referenced in any other configuration element.\n\n F5 Trigger\n\n This section details how to configure the Triggers that will be used by WebRA Profiles to push or delete certificates to/from F5 BigIP.\n\n Prerequisites\n\n F5 Connector\n\n How to configure F5 Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access F5 Triggers from the drawer or card: Third Parties > F5 > Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon use the name to identify the trigger.\n\n F5 Connector * (select) :\n\nSelect a connector F5 previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the F5 BigIP repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the F5 Trigger.\n\n Integration of the third party to the WebRA\n\n When having configured the connector, it is possible to automate its elements' lifecycle using the WebRA.\n\n Automation using triggers\n\n Triggers are a functionality of WebRA that allows to push lifecycle events into a third party whenever they occur on a WebRA profile.\n\n 1. Refer to the trigger documentation to create a trigger.\n\n 2. Create or modify the WebRA profile you wish to use the triggers on.\n\n 3. Go to the Triggers tab, then on Certificate lifecycle triggers\n\n 4. Chose which lifecycle events you wish to use triggers upon (enrollment, revocation, expiration)\n\n 5. Select one or more existing triggers from the menu (if several are selected, they will all be called whenever the selected event occurs)\n\n 6. Click on the Save button.\n\n From now on, whenever a selected lifecycle event will occur on the configured WebRA profile, the trigger will be called and the and the certificate will be pushed into or removed from the third party container.\n\n Automation using scheduled tasks\n\n Scheduled tasks are a functionality of WebRA that allows to synchronize automatic renewal or revocation events with a third party periodically with what occurs on a WebRA profile.\nTo be more specific, it will periodically check whether the certificate has entered the \"renewal period\" that was defined in the connector’s configuration, and renew it automatically if necessary.\n\n 1. Refer to the third party connector documentation to create a third party connector.\n\n 2. Ensure you have an existing WebRA profile : renewal will be automated on the selected profile.\n\n 3. Follow the documentation of the WebRA scheduled tasks section to properly configure a scheduled task.\n\n Azure Key Vault Integration\n Intune", - "keywords": [ - "f5", - "bigip", - "integration", - "admin-guide", - "admin-guide/third-parties/f5", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:third-parties:intune", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Intune", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/intune.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/intune.html", - "breadcrumbs": ["Horizon", "Admin guide", "Third parties", "Intune"], - "summary": "Intune ⚠ Deprecated: This version reached LDOS on 16/05/2025. Introduction This section details the Microsoft Endpoint Manager - Intune SCEP integration with Horizon, used to enroll, renew and revoke certificates on Intune managed devices. ", - "content": "Intune\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Introduction\n\n This section details the Microsoft Endpoint Manager - Intune SCEP integration with Horizon, used to enroll, renew and revoke certificates on Intune managed devices.\n\n This integration involves at least three infrastructure components:\n\n Microsoft Endpoint Manager / Intune\n\n Azure Active Directory\n\n EverTrust Horizon\n\n The enrolled devices interface with these components in order to retrieve their certificate.\n\n The diagram displays these components as well as the various flows involved in an enrollment.\n\n Microsoft describes the integration principles on their website: https://docs.microsoft.com/en-us/mem/intune/protect/certificate-authority-add-scep-overview\n\n Finally, this integration will require to set up, on Horizon side, the following elements:\n\n an Intune Connector, which holds the configuration items required for Horizon to connect to Azure AD and Intune\n\n an Intune Profile, which holds the configuration items specifying how Horizon should issue certificates for the specified Intune Connector\n\n an Intune Scheduled Task, which holds configuration items defining the scheduled task in charge of performing revocation upon decommissioning devices from Azure AD. This is optional.\n\n Intune Connector\n\n This section details how to configure an Intune Connector.\n\n Required By\n\n Intune Profile\n\n Intune Scheduled Task\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy , used to reach Azure/Intune, if necessary.\n\n On Azure AD side, it is required to set up an application by following Microsoft’s guide . Please note that you must add the Microsoft Graph / Directory.Read.All permission as well for the revocation feature to work properly. After performing these steps, you will get the following information, required later:\n\n the Tenant ID\n\n the Application ID\n\n the Application Authentication Key\n\n How to configure Intune Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune Connector from the drawer or card: Third Parties > Intune > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Azure Tenant * (string input) :\n\nEnter the Tenant ID.\n\n App ID * (string input) :\n\nEnter the Application ID.\n\n App Key * (string input) :\n\nEnter the Application Authentication Key.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy used to reach Azure AD and Intune.\n\n Timeout ( finite duration ) :\n\nTimeout set on the connection used to reach Azure AD and Intune. Configured by default at 10 seconds. Must be a valid finite duration.\n\n Assets identification and management\n\n OS query string (string input) :\n\nThis allows to restrict devices by OS when performing the devices listing used for the revocation feature. Leave blank to use the default setting if unsure.\n\n Intune resource URL (string input) :\n\nThis allows to point at a specific Intune installation. Used only in Hybrid Intune setups, leave blank otherwise.\n\n Legacy revocation mode (boolean) :\n\nActivate the legacy revocation mode. Default value is set to false.\n\n Actors management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default to 3.\n\n 5. Click on the save button.\n\n You can update or delete the Intune Connector.\n\n You will not be able to delete an Intune Connector if it is referenced in any other configuration element.\n\n Intune Profile\n\n This section details how to configure an Intune Profile.\n\n Required By\n\n Intune Scheduled Tasks\n\n Prerequisites\n\n Intune Connector\n\n PKI Connector\n\n SCEP Authority\n\n Setting up an SCEP Authority requires you to issue a certificate from the underlying PKI with the following characteristics:\n\n the issuing CA should be the same as the one that will issue certificates through the PKI Connector that will be linked to the Intune Profile\n\n the certificate key usages must include Digital Signature and Key Encipherment\n\n the certificate must be issued as PKCS#12 and then imported into Horizon\n\n How to configure Intune Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune Profile from the drawer or card: Third Parties > Intune > Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of an URL, it is advised to use only lower case letters and dashes.\n\n Enabled * (boolean) :\n\nIndicates whether the profile is enabled or not. Set to true by default.\n\n Intune Connector * (select) :\n\nSelect an Intune Connector previously created.\n\n PKI Connector (select) :\n\nSelect a PKI connector previously created.\n\n Max certificate per holder (int) :\n\nIf specified, defines the maximum number of active certificates for a given Holder. If the number of active certificates exceeds this parameter, then the oldest certificate(s) above the limit will be automatically revoked.\n\n Assets identification\n\n Device ID field name (string input) :\n\nSubject DN field used to retrieve the Device ID. The selected field must be set to {{AAD_Device_ID}} on Intune side, e.g. if you select \"L\", the configured Subject DN in the SCEP profile in Intune must then contain L={{AAD_Device_ID}} . This is required to use the automated revocation feature upon device decommission.\n\n Device ID separator (string input) :\n\nSeparator used to retrieve the Device ID in the device id field (if defined). This field is present for backward compatibility reasons and should normally be left to blank.\n\n SCEP protocol parameters\n\n Mode * (select) :\n\nChoose from one of the two modes RA or CA. Usually this should be set to RA .\n\n SCEP Authority (select) :\n\nSelect a SCEP Authority previously created. See Prerequisites for details.\n\n CAPS (select) :\n\nSelect one or many SCEP Capabilities from the list. If unsure, leave the default.\n\n Encryption algorithm (select) :\n\nSelect a SCEP Encryption Algorithm algorithms from the list. If unsure, leave the default.\n\n Renewal management\n\n Renewal period ( finite duration ) :\n\nMust be a valid finite duration.\n\n Revocation on SCEP renew *: (boolean)\n\nShould the expiring certificate be revoked upon SCEP renewal. Set by default to false.\n\n Revocation reason * (select) :\n\nSelect the reason from the list. Available only if revocation on SCEP renew is set to true.\n\n Self Permissions\n\n Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to revoke the certificate with no validation workflow. Set to false by default.\n\n Request Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request the revocation of the certificate. Set to false by default.\n\n Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to update the certificate with no validation workflow. Set to false by default.\n\n Request Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request certificate’s update. Set to false by default.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can update or delete the Intune Profile once it has been created.\n\n You won’t be able to delete an Intune Profile if it is referenced somewhere else.\n\n Last steps\n\n Once the profile created in Horizon, you need to setup a SCEP profile in Intune by following Microsoft documentation . You will need to match the parameters in the Intune SCEP profile with what has been set up in Horizon and in the underlying PKI. You need to pay special attention to:\n\n the certificate lifetime and renewal interval, which must match throughout the solution\n\n the Subject and Subject Alternative Name settings must match throughout the solution. In the end, the issued certificate must contain exactly what was configured in Intune for these fields, or the renewal will not work.\n\n the SCEP server URL, where you need to input the URL given in the Intune Profile that you created in Horizon\n\n To enroll Windows machines or users using Intune, you need to remove the trailing \" pkiclient.exe \" from the SCEP server URL\n\n Intune Scheduled Tasks\n\n This section details how to configure scheduled tasks which will run periodically on your Intune profiles, in order to manage automatic revocation upon device decommission.\n\n Prerequisites\n\n Intune Connector\n\n Intune Profile\n\n How to configure Intune Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune Scheduled Tasks from the drawer or card: Third Parties > Intune > Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Intune Profile * (select) :\n\nSelect an Intune profile previously created.\n\n Target Connector * (select) :\n\nSelect an Intune connector previously created.\n\n Cron scheduling ( cron expression ) :\n\nSet to every 5 hours by default.\n\n Revoke (boolean) :\n\nSet to false by default. If true, Horizon will revoke any certificate associated to a device that has been deleted from Azure AD (and hence decommissioned).\n\n Dry run (boolean) :\n\nIf enabled, revocation actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run , update or delete the Scheduled Tasks.\n\n F5 BigIP Integration\n Intune PKCS Connector", - "keywords": [ - "intune", - "admin-guide", - "admin-guide/third-parties/intune", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:third-parties:intunepkcs", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Intune PKCS Connector", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intunepkcs", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/intunepkcs.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/intunepkcs.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "Intune PKCS Connector" - ], - "summary": "Intune PKCS Connector ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to configure the Intune PKCS Connector. This integration involves at least three infrastructure components: Microsoft Endpoint Manager / I", - "content": "Intune PKCS Connector\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to configure the Intune PKCS Connector.\n\n This integration involves at least three infrastructure components:\n\n Microsoft Endpoint Manager / Intune\n\n Azure Active Directory\n\n EverTrust Horizon\n\n The enrolled devices interface with these components in order to retrieve their certificate.\n\n The diagram displays these components as well as the various flows involved in an enrollment.\n\n Required By\n\n Intune PKCS Profile\n\n How to configure Intune PKCS Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Connectors from the drawer or card: Third Parties > Intune PKCS > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Azure Tenant * (string input) :\n\nValue must be set to Azure Tenant.\n\n App ID * (string input) :\n\nValue must be set to Azure App ID.\n\n App Key * (string input) :\n\nValue must be set to Azure App Key.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy to use.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be in valid finite duration.\n\n Search Filter (string input) :\n\nEnter search filter.\n\n Max stored certificates per holder (int) :\n\nWhen specified, define the maximum number of certificates stored in the third party for a given holder.\n\n Assets identification and management\n\n Key Name (string input) :\n\nEnter key name.\n\n Key Type (select) :\n\nSelect one key type from the list.\n\n Provider Name (string input) :\n\nEnter provider name.\n\n Public Key (string input) :\n\nEnter public key in PEM format.\n\n Intended Purpose (select) :\n\nSelect one intended certificate usage from the list.\n\n Actors and renewal management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default at 3.\n\n Renewal period ( finite duration ) :\n\nMust be a valid finite duration.\n\n 5. Click on the save button.\n\n You can update or delete the Intune PKCS Connector.\n\n You won’t be able to delete an Intune PKCS Connector if it is referenced in any other configuration element.\n\n Intune PKCS Profile\n\n This section details how to configure the Intune PKCS Profile\n\n Required By\n\n Intune PKCS Scheduled Tasks\n\n Prerequisites\n\n PKI Connector\n\n How to configure Intune PKCS Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Profiles from the drawer or card: Third Parties > Intune PKCS > Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each profile. Horizon uses the name to identify the profile.\n\n Enabled * (boolean) :\n\nIs the profile enabled or not. Set at true by default.\n\n Max certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n PKI Connector (select) :\n\nSelect a PKI connector previously created.\n\n Intune PKCS Connector * (select) :\n\nSelect an Intune PKCS Connector previously created.\n\n Crypto Policy\n\n Private key escrowing (boolean) :\n\nIs the private key escrowing. Set at false by default.\n\n PKCS#12 Password generation mode * (select) :\n\nDefine if the PKCS#12 password is chosen by the user on the request (manual) or generate randomly (random).\n\n Password policy for PKCS#12 password * (select) :\n\nSelect a password policy previously created.\n\n Store encryption type (select) :\n\nSelect from the list the encryption type. If unsure, leave on default \"DES_AVERAGE\".\n\n Show PKCS#12 Password On Recover (boolean) :\n\nShould the PKCS#12 password be displayed on recover. Activated with the private key escrowing.\nSet to false by default.\n\n Show PKCS#12 On Recover (boolean) :\n\nShould the PKCS#12 be displayed on recover. Activated with the private key escrowing.\nSet to false by default.\n\n Self Permissions\n\n Revoke (boolean) :\n\nHave the right to self revoke. Set by default at false.\n\n Request Revoke (boolean) :\n\nHave the right to self request revoke. Set by default at false.\n\n Update (boolean) :\n\nHave the right to self update. Set by default at false.\n\n Request Update (boolean) :\n\nHave the right to self request update. Set by default at false.\n\n Recover (boolean) :\n\nHave the right to self Recover the certificate. Set by default at false.\n\n Request recover (boolean) :\n\nHave the right to self request recover. Set by default at false.\n\n Triggers\n\n Intune PKCS profiles support the use of third-party triggers in the form of callbacks on specific events happening on the profile, giving a way to synchronize the third party repositories and Horizon.\n\n Enrollment (select) :\n\nSelect the third party trigger(s) to call whenever a certificate is enrolled on this profile.\n\n Revocation (select) :\n\nSelect the third party trigger(s) to call whenever a certificate gets revoked on this profile.\n\n Expire (select) :\n\nSelect the third party trigger(s) to call whenever a certificate expires on this profile.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can update or delete the Intune PKCS Profile.\n\n You won’t be able to delete an Intune PKCS Profile if it is referenced in any other configuration element.\n\n Intune PKCS Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically on your Intune PKCS profiles.\n\n Prerequisites\n\n Connector Intune PKCS\n\n Profile Intune PKCS\n\n How to configure Intune PKCS Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Scheduled Tasks from the drawer or card: Third Parties > Intune PKCS > Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Enabled (boolean) :\n\nTells whether the Scheduled task should be enabled. Set by default at true.\n\n Intune PKCS Profile * (select) :\n\nSelect an Intune PKCS profile previously created.\n\n Target Connector * (select) :\n\nSelect an Intune PKCS connector previously created.\n\n Cron scheduling ( cron expression ) :\n\nBy default set at every 5 hours.\n\n Enroll? (boolean) :\n\nIf enabled, will enroll all certificate from the third party repository.\nSet to false by default.\n\n Revoke? (boolean) :\n\nIf enabled, will revoke all certificate whose container was deleted from the third party repository.\nSet to false by default.\n\n Renew? (boolean) :\n\nIf enabled, will renew all certificate who are about to expire.\nSet to false by default.\n\n Dry run (boolean) :\n\nIf enabled, enroll, revocation and renewal actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run or update or delete the Schedules Tasks.\n\n Intune PKCS Trigger\n\n this section details how to configure the Triggers that will run automatically on your Intune PKCS connectors.\n\n Prerequisites\n\n Intune PKCS Connector\n\n How to configure Intune PKCS Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Triggers from the drawer or card: Third Parties > Intune PKCS > Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n Intune PKCS Connector * (select) :\n\nSelect an Intune PKCS connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the Intune PKCS repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the Intune PKCS Trigger.\n\n You won’t be able to delete an Intune PKCS Trigger if it is referenced in any other configuration element.\n\n Intune\n jamf Pro", - "keywords": [ - "intune", - "pkcs", - "connector", - "admin-guide", - "admin-guide/third-parties/intunepkcs", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:third-parties:jamf", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "jamf Pro", - "section": "admin-guide", - "slug": "admin-guide/third-parties/jamf", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/jamf.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/jamf.html", - "breadcrumbs": ["Horizon", "Admin guide", "Third parties", "jamf Pro"], - "summary": "jamf Pro ⚠ Deprecated: This version reached LDOS on 16/05/2025. Introduction This section details the jamf Pro integration with Horizon, used to enroll, renew and revoke certificates on jamf Pro managed devices. This integration involves th", - "content": "jamf Pro\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Introduction\n\n This section details the jamf Pro integration with Horizon, used to enroll, renew and revoke certificates on jamf Pro managed devices.\n\n This integration involves the following components:\n\n jamf Pro server or Cloud instance\n\n EverTrust Horizon\n\n Devices to be enrolled\n\n The diagram displays these components as well as the various flows involved in an enrollment.\n\n Finally, this integration will require to setup, on Horizon side, the following elements:\n\n a jamf Connector, which holds the configuration items required for Horizon to connect to jamf Pro\n\n a jamf Profile, which holds the configuration items specifying how Horizon should issue certificates for the specified jamf Connector\n\n a jamf Scheduled Task, which holds configuration items defining the scheduled task in charge of performing revocation upon decommissioning devices from jamf Pro. This is optional.\n\n jamf Connector\n\n This section details how to configure a jamf Connector.\n\n Required By\n\n jamf Profile\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy used to reach jamf Pro, if necessary.\n\n On jamf Pro side, it is required to create a technical user for Horizon, and give it Auditor rights, so that Horizon will be able to list the devices managed by jamf Pro and thus be able to trigger certificate revocation upon decommissioning. Please follow the steps from the jamf Pro documentation . After performing these steps, you will be given the following information, required later:\n\n a login\n\n a password\n\n How to configure jamf Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access jamf Connector from the drawer or card: Third Parties > Jamf > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Jamf endpoint URL * (string input) :\n\nEnter the URL pointing to the jamf deployment or the jamf Cloud instance.\n\n Login * (string input) :\n\nEnter the username created for Horizon in jamf.\n\n Password * (string input) :\n\nEnter the password associated with aforementioned username.\n\n Proxy (select) :\n\nThe HTTP/HTTPS proxy used to reach jamf Pro, if any.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be a valid finite duration.\n\n Actors management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default to 3.\n\n 5. Click on the save button.\n\n You can update or delete the jamf Connector.\n\n You won’t be able to delete a jamf Connector if it is referenced in any other configuration element.\n\n jamf Profile\n\n This section details how to configure a jamf Profile\n\n Prerequisites\n\n jamf Connector\n\n PKI Connector\n\n SCEP Authorities\n\n The SCEP Authority setup requires you to issue a certificate from the underlying PKI with the following characteristics:\n\n to issue certificates for iOS:\n\n the issuing CA should be the same as the one that will issue certificates through the PKI Connector that will be linked to the jamf Profile\n\n the certificate key usages must include Digital Signature and Key Encipherment\n\n the certificate must be issued as PKCS#12 and then imported into Horizon\n\n to issue certificates for macOS:\n\n the certificate should be self-signed\n\n the certificate key usages must include Digital Signature and Key Encipherment\n\n the certificate must be issued as PKCS#12 and then imported into Horizon\n\n How to configure jamf Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access jamf Profiles from the drawer or card: Third Parties > Jamf > Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of an URL, it is advised to use only lower case letters and dashes.\n\n Enabled (boolean) :\n\nIs the profile enabled or not. Set at true by default.\n\n jamf Connector (select) :\n\nSelect a jamf connector previously created.\n\n PKI connector * (select) :\n\nSelect a PKI Connector previously created.\n\n Max certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Assets identification\n\n DN field containing the device UDID * (select) :\n\nField used to retrieve the Device ID. The selected field must be set to $UDID/$COMPUTERNAME on jamf side, e.g. if you select \"L\", the configured Subject DN in the SCEP profile in jamf pro must then contain L=$UDID for iOS or L=$COMPUTERNAME for macOS devices. This allows to use the automated revocation upon device decommissioning feature.\n\n SCEP protocol parameters\n\n Mode * (select) :\n\nChoose from the two modes RA or CA. To enroll certificates on iOS devices, select the RA mode. To enroll certificates on macOS , select the CA mode.\n\n SCEP Authority * (select) :\n\nSelect a SCEP Authority previously created. See Prerequisites for details.\n\n CAPS (select) :\n\nSelect one or many SCEP Capabilities from the list. If unsure, leave the default.\n\n Encryption algorithm * (select) :\n\nSelect a SCEP Encryption Algorithm algorithms from the list. If unsure, leave the default.\n\n Password policy (select) :\n\nChoose from the password policy you might have previously created. If unsure, leave the default.\n\n Renewal management\n\n Renewal period ( finite duration ) :\n\nMust be in valid finite duration.\n\n Revocation on SCEP renew *: (boolean)\n\nShould the expiring certificate be revoked upon SCEP renewal. Set by default at false.\n\n Revocation reason * (select) :\n\nSelect the reason from the list. Available only if revocation on SCEP renew at true.\n\n Self Permissions\n\n Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to revoke the certificate with no validation workflow. Set to false by default.\n\n Request Revoke (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request the revocation of the certificate. Set to false by default.\n\n Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to update the certificate with no validation workflow. Set to false by default.\n\n Request Update (boolean) :\n\nSpecify whether the certificate’s owner is authorized to request certificate’s update. Set to false by default.\n\n You can further configure the profile using the Common configuration profile and Notification tabs.\n\n 5. Click on the save button.\n\n You can update or delete the jamf Profile .\n\n You won’t be able to delete a jamf Profile if it is referenced somewhere else.\n\n Last Steps\n\n The integration between jamf Pro and Horizon can be done in the following modes:\n\n jamf Pro SCEP Proxy mode\n\n iOS SCEP Profile\n\n macOS SCEP Profile\n\n macOS SCEP Profile with Proxy\n\n In all these modes, the Challenge type to use on jamf Pro side is Dynamic-Microsoft CA , and you should point to the corresponding mscep and mscep_admin URI on Horizon side, that can be found in the jamf Profile after it has been created.\n\n Jamf Pro SCEP Proxy mode\n\n This mode requires to provide the SCEP Authority PKCS#12 to jamf Pro, so that it can be uploaded in the appropriate profile.\n\n Other than that, the configuration looks like the following on Jamf Pro side:\n\n iOS/macOS SCEP Profile\n\n On jamf Pro side, the profile configuration looks like the following:\n\n macOS SCEP Profile with Proxy\n\n This mode requires:\n\n to set up the SCEP Proxy mode on jamf Pro side\n\n to configure a profile on jamf Pro side, that looks like the following:\n\n jamf Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically on your jamf profiles, in order to manage automatic revocation upon device decommissioning.\n\n Prerequisites\n\n jamf Connector\n\n jamf Profile\n\n How to configure jamf Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access jamf Scheduled Tasks from the drawer or card: Third Parties > jamf > Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Enabled (boolean) :\n\nTells whether the Scheduled task should be enabled. Set by default at true.\n\n jamf Profile * (select) :\n\nSelect a jamf profile previously created.\n\n Target Connector * (select) :\n\nSelect an jamf connector previously created.\n\n Cron scheduling ( cron expression ) :\n\nSet to every 5 hours by default.\n\n Revoke (boolean) :\n\nSet to false by default. If true, Horizon will revoke any certificate associated to a device that has been deleted from Azure AD (and hence decommissioned).\n\n Dry run (boolean) :\n\nIf enabled, revocation actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run or update or delete the Scheduled Tasks.\n\n Intune PKCS Connector\n LDAP", - "keywords": [ - "jamf", - "pro", - "admin-guide", - "admin-guide/third-parties/jamf", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:third-parties:ldap", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "LDAP", - "section": "admin-guide", - "slug": "admin-guide/third-parties/ldap", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/ldap.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/third-parties/ldap.html", - "breadcrumbs": ["Horizon", "Admin guide", "Third parties", "LDAP"], - "summary": "LDAP ⚠ Deprecated: This version reached LDOS on 16/05/2025. Introduction This section details the LDAP integration with Horizon, used to publish and unpublish certificates on LDAP. The integration will require to set up the following elemen", - "content": "LDAP\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Introduction\n\n This section details the LDAP integration with Horizon, used to publish and unpublish certificates on LDAP.\n\n The integration will require to set up the following elements (on Horizon side):\n\n an LDAP Connector, which holds the configuration items required by Horizon to connect to LDAP\n\n an LDAP Trigger, which holds the configuration items specifying how Horizon should publish/unpublish certificates for the specified LDAP connector\n\n Only SMIME Certificates can be published\n\n LDAP Connector\n\n This section details how to configure an LDAP Connector.\n\n Required By\n\n LDAP trigger\n\n Prerequisites\n\n On the LDAP side, it is required to create a technical user with permissions to write in the LDAP sub DN, so that Horizon will be able to search by email, to publish and to unpublish certificates using that technical user. The following information will be required later:\n\n LDAP Hostname\n\n a login DN\n\n a password\n\n Base DN to publish SMIME certificates\n\n How to configure LDAP Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access LDAP Connector from the drawer or card: Third Parties > LDAP > Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Hostname * (string input) :\n\nEnter the URL pointing to LDAP.\n\n Login DN * (string input) :\n\nEnter the DN technical user created for Horizon.\n\n Password * (string input) :\n\nEnter the password associated with the login.\n\n Base DN * (string input) :\n\nEnter the Base DN where Horizon should publish the certificate.\n\n Max stored certificates per holder * (int) :\n\nWhen specified, define a maximum number of certificates stored in the third party.\n\n Port (int) :\n\nEnter the port where to reach the running LDAP instance (default values are 389 for LDAP and 636 for LDAPS).\n\n Proxy (string input) :\n\nThe HTTP/HTTPS proxy used to reach LDAP, if any.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be a valid finite duration.\n\n Assets identification\n\n Filter * (string input) :\n\nEnter the custom filter. By default, LDAP Identities are filtered by (objectclass=user). If you are using inetOrgPerson as type, you will have to manually set the following filter: (objectclass=inetOrgPerson).\n\n Target LDAP publication attribute (string input) :\n\nWhen specified, the certificate will be published on the specified attribute. In most LDAP applications you will have to set the field to: \"userCertificate;binary\" but in MSAD the field is already well managed.\n\n Actors management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default to 3.\n\n 5. Click on the save button.\n\n You can update or delete the LDAP Connector.\n\n You won’t be able to delete a LDAP Connector if it is referenced in any other configuration element.\n\n LDAP Triggers\n\n Here is the section to manage the Triggers that will be used by profiles to publish or unpublish certificates into LDAP.\n\n Prerequisites\n\n LDAP Connector\n\n How to configure LDAP trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access LDAP triggers from the drawer or card: Third Parties > LDAP > Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n LDAP Connector Certificate Publication * (select) :\n\nSelect an LDAP connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the Intune PKCS repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can run or update or delete the trigger.\n\n Integration of the third party to the WebRA\n\n When having configured the connector, it is possible to automate its elements' lifecycle using the WebRA.\n\n Automation using triggers\n\n Triggers are a functionality of WebRA that allows to push lifecycle events into a third party whenever they occur on a WebRA profile.\n\n 1. Refer to the trigger documentation to create a trigger.\n\n 2. Create or modify the WebRA profile you wish to use the triggers on.\n\n 3. Go to the Triggers tab, then on Certificate lifecycle triggers\n\n 4. Chose which lifecycle events you wish to use triggers upon (enrollment, revocation, expiration)\n\n 5. Select one or more existing triggers from the menu (if several are selected, they will all be called whenever the selected event occurs)\n\n 6. Click on the Save button.\n\n From now on, whenever a selected lifecycle event will occur on the configured WebRA profile, the trigger will be called and the and the certificate will be pushed into or removed from the third party container.\n\n jamf Pro\n SCEP Authorities", - "keywords": [ - "ldap", - "admin-guide", - "admin-guide/third-parties/ldap", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.3:admin-guide:user_informations", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "User Information", - "section": "admin-guide", - "slug": "admin-guide/user_informations", - "url": "https://docs.evertrust.fr/horizon/2.3/admin-guide/user_informations.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/user_informations.html", - "breadcrumbs": ["Horizon", "Admin guide", "User Information"], - "summary": "User Information ⚠ Deprecated: This version reached LDOS on 16/05/2025. This is the section where to find all your profile information (identifier, email, name, authentication type, role and permissions), your preferences and change your ac", - "content": "User Information\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This is the section where to find all your profile information (identifier, email, name, authentication type, role and permissions), your preferences and change your account password (local account authentication only).\n\n Profile access\n\n 1. Log in to Horizon.\n\n 2. Access your profile from the header by clicking on your account name.\n\n How to change your password\n\n 1. Profile access\n\n 2. Fill your local password and confirm it.\n\n 3. Click on the 'Change Password' button.\n\n Changing your password is only available if you are using a local account.\n\n How to change your preferences\n\n 1. Profile access\n\n 2. Change your preferences:\n\n Appearance (light/dark mode)\n\n Horizon default language\n\n 3. Click on the 'Save' button.\n\n Introduction\n Certification Authorities", - "keywords": [ - "user", - "information", - "admin-guide", - "admin-guide/user_informations", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.3:install-guide:access", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "First login", - "section": "install-guide", - "slug": "install-guide/access", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/access.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/install-guide/access.html", - "breadcrumbs": ["Horizon", "Installation", "First login"], - "summary": "First login ⚠ Deprecated: This version reached LDOS on 16/05/2025. Log in Launch a web browser. Browse to https://[Horizon IP or FQDN]/ui#/login : If you don’t see any Authentication method (you should see Local if the database has been set", - "content": "First login\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Log in\n\n Launch a web browser.\n\n Browse to https://[Horizon IP or FQDN]/ui#/login :\n\n If you don’t see any Authentication method (you should see Local if the database has been setup), you must Manually create the initial user .\n\n The default administration credentials are:\n\n Login: administrator\n\n Password: horizon\n\n Specify the default administration credentials and hit the Login button:\n\nIt is highly recommended to create a dedicated administration account and delete the default one, or at least modify the default administrator password.\n\n Manually create the initial user\n\n Launch a MongoDB shell to access your database and run the following command to create the initial administrator:\n\n use horizon;\ndb.security_local_identities.insert({\"identifier\":\"administrator\",\"hash\":\"$6$8JDCzmb9XDpOwtGQ$7.kRdgIjPYR/AxPbzKsdkBH3ouCgFbqyH9csjcr5qIoIXK/f2L6bQYQRhi9sdQM4eBm8sGUdEkg.TVOQ1MRsA/\",\"name\":\"Horizon Administrator\"});\ndb.security_principals.insert({\"identifier\":\"administrator\",\"permissions\":[{\"value\":\"configuration:*\"},{\"value\":\"lifecycle:*\"}],\"roles\":[]});\ndb.security_identity_providers.insert({\"enabled\":true,\"type\":\"Local\",\"name\":\"local\",\"enabledOnUI\":true});\n\n Installing with Docker\n Troubleshooting", - "keywords": [ - "first", - "login", - "install-guide", - "install-guide/access", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.3:install-guide:docker", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Installing with Docker", - "section": "install-guide", - "slug": "install-guide/docker", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/docker.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/docker.html", - "breadcrumbs": ["Horizon", "Installation", "Installing with Docker"], - "summary": "Installing with Docker ⚠ Deprecated: This version reached LDOS on 16/05/2025. Log in to the EverTrust Docker registry : $ docker login registry.evertrust.io Pull the latest Horizon image : $ docker pull registry.evertrust.io/horizon:2.3.X T", - "content": "Installing with Docker\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Log in to the EverTrust Docker registry :\n\n $ docker login registry.evertrust.io\n\n Pull the latest Horizon image :\n\n $ docker pull registry.evertrust.io/horizon:2.3.X\n\n The Horizon Docker image ships with sensible configuration defaults. Most can be configured by injecting environment variables when running the container, like so :\n\n $ docker run \\\n -e LICENSE=\"\" \\\n -e MONGODB_URI=\"\" \\\n -e APPLICATION_SECRET=\"\" \\\n -e HOSTS_ALLOWED.0=\"\" \\\n -e HOSTS_ALLOWED.1=\"\" \\\n -p [port]:9000 \\\n registry.evertrust.io/horizon:2.3.X\n\n Here’s a full list of environment variables used by the default config :\n\n Variable\n Description\n\n LICENSE\n\n A valid Horizon license string, base64-encoded.\n\n APPLICATION_SECRET\n\n Application secret used by Horizon\n\n MONGODB_URI\n\n A valid MongoDB URI. See iaas/setup/horizon.adoc#mongo_uri_config .\n\n SSV_PASSWORD\n\n If empty, the APPLICATION_SECRET value will be used.\n\n HOSTS_ALLOWED\n\n Array of hosts. Append the array index after a dot (the nth allowed host variable name would be HOSTS_ALLOWED.n).\n\n SMTP_HOST\n\n SMTP_PORT\n\n SMTP_SSL\n\n SMTP_TLS\n\n SMTP_USER\n\n SMTP_PASSWORD\n\n Your license usually contains newline characters, that you must replace by '\\n' when setting it through the environment.\n\n Should you need to have full control over the config in the container, and assuming that you have a valid configuration according to the Administration Guide and have a license file, you can mount a folder containing the configuration to /horizon/etc :\n\n $ docker run \\\n -v [configurationPath]:/horizon/etc:rw \\\n -p [port]:9000 \\\n registry.evertrust.io/horizon:{page-component-version}\n\n You need to use the configuration folder’s absolute path.\n\n The configuration folder must contain the horizon.lic file.\n\n Advanced usage\n First login", - "keywords": [ - "installing", - "with", - "docker", - "install-guide", - "install-guide/docker", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:access", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Initial Horizon access", - "section": "install-guide", - "slug": "install-guide/iaas/access", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/access.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/access.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Initial Horizon access" - ], - "summary": "Initial Horizon access ⚠ Deprecated: This version reached LDOS on 16/05/2025. Starting the Horizon services Access the server through SSH with an account with administrative privileges; Start the horizon service with the following command: ", - "content": "Initial Horizon access\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Starting the Horizon services\n\n Access the server through SSH with an account with administrative privileges;\n\n Start the horizon service with the following command:\n\n $ systemctl start horizon\n\n Start the nginx service with the following command:\n\n $ systemctl start nginx\n\n You can now continue to First login to log in to the web UI.\n\n Server Authentication Certificate\n Standard Upgrade", - "keywords": [ - "initial", - "horizon", - "access", - "install-guide", - "install-guide/iaas/access", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:backup", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Backup and Restore", - "section": "install-guide", - "slug": "install-guide/iaas/backup", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/backup.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/backup.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Backup and Restore" - ], - "summary": "Backup and Restore ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how to back-up and restore Horizon. Back-up and restore operation can be performed using the back-up and restore tool available under /opt/horizo", - "content": "Backup and Restore\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how to back-up and restore Horizon. Back-up and restore operation can be performed using the back-up and restore tool available under /opt/horizon/sbin/horizon-backup . It is designed to be used only in RPM-Based deployments.\n\n For Docker or Kubernetes based deployments, the configuration should be managed by the Docker/Kubernetes management platform, and the database should be backed-up using MongoDB tools.\n\n Backup Procedure\n\n This section details how to back up Horizon configuration elements.\n\n Several elements can be backed up:\n\n The Horizon configuration files.\n\n The Horizon MongoDB.\n\n The backup tool allows backing up these elements independently.\n\n $ /opt/horizon/sbin/horizon-backup --help\n usage: horizon-backup [-cdho:qs]\n -c | --conf Backup the configuration files\n -d | --db Backup the MongoDB database\n -h | --help Display the 'horizon-backup' help\n -o | --output [path] Specify the backup output folder (default: '/opt/horizon/var/backup')\n -q | --quiet Quiet mode\n\n To back up the configuration files, run the following command:\n\n $ /opt/horizon/sbin/horizon-backup -c\n\n The configuration files backup consists of a compressed archive ( .tar.gz ) located under /opt/horizon/var/backup/ .\n\n To back up the MongoDB database, run the following command:\n\n $ /opt/horizon/sbin/horizon-backup -d\n\n The MongoDB database backup consists of a compress file ( .gz ) located under /opt/horizon/var/backup/ .\n\n To run a complete backup, execute the following command:\n\n $ /opt/horizon/sbin/horizon-backup -c -d\n\n The backup output folder can be overridden using the -o | --output parameter\n\n The backup tool can operate in quiet mode (when scheduled in a cron job) using the -q | --quiet parameter\n\n Restoration Procedure\n\n This section details how to restore horizon configuration elements.\n\nThis restore procedure only applies to the exact same application version as the backup file.\n\n Restoration operation should be performed while the Horizon service is not running. Stop the Horizon service with the following command:\n\n $ systemctl stop horizon\n\n To restore a configuration backup, run the following command:\n\n $ tar xzpvf [horizon configuration backup archive path] -C/\n\n To restore the MongoDB database, run the following command:\n\n $ mongorestore --uri=\"[MongoDB URI]\" --drop --gzip --archive=[horizon MongoDB backup archive path]\n\n The MongoDB URI can be retrieved from the /etc/default/horizon/_* configuration file, as MONGODB_URI parameter.\n\n The Horizon service can now be started with the following command:\n\n $ systemctl start horizon\n\n Upgrading from a version prior to 2.1.0\n Uninstallation", - "keywords": [ - "backup", - "and", - "restore", - "install-guide", - "install-guide/iaas/backup", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:doctor", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon Doctor", - "section": "install-guide", - "slug": "install-guide/iaas/doctor", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/doctor.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/doctor.html", - "breadcrumbs": ["Horizon", "Horizon Doctor"], - "summary": "Horizon Doctor ⚠ Deprecated: This version reached LDOS on 16/05/2025. Horizon doctor is a tool that performs checks on your Horizon installation as well as its required dependencies to ensure that everything is configured properly. The tool", - "content": "Horizon Doctor\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Horizon doctor is a tool that performs checks on your Horizon installation as well as its required dependencies to ensure that everything is configured properly.\nThe tool is targeted towards troubleshooting during installation or update procedures.\nNote that the tool requires root permissions to run.\n\n Performed checks\n\n At the moment, Horizon Doctor checks for:\n\n OS checks\n\n Checks for installed Horizon version, MongoDB version, Java version, Nginx version, OS Version.\n\n If the OS is a RedHat distribution, checks if the RedHat subscription is active\n\n If Mongo is not installed locally, it notices it as an information log\n\n Checks for SELinux 's configuration : throws a warning if it is enabled, says ok if it is on permissive or disabled\n\n Checks for the status of the necessary services: postfix , mongod , nginx and horizon .\n\n If the postfix service is running, tries to connect via a TCP SYN on the port 25 of the relayhost specified in the /etc/postfix/main.cf file and throws an error if it can’t.\n\n Checks how long the Horizon service has been running for.\n\n Checks if there is an NTP service active on the machine and checks if the system clock is synchronized with the NTP service.\n\n Config checks\n\n Checks for existence and permissions of the configuration file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon\n\n Checks for existence and permissions of the licence file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for existence and permissions of the vault file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for the permission of the Horizon directory (default: /opt/horizon): the permission is expected to be at least 755.\n\n Checks for the existence of the symbolic link for nginx configuration and runs an nginx -t test.\n\n Retrieves the Java heap size parameters that were set for Horizon and throws a warning if the default ones are used (min = 2048 and max = 3072).\n\n Retrieves the Horizon DNS hostname and stores it for a later test (throws an error if it has not been set).\n\n Checks for the Horizon Play Secret and Horizon Event Seal Secret : these are the Horizon application secrets and should be different from default value thus Horizon Doctor throws an error if either of them is equal to the default value ( changeme ).\n\n Retrieves the MongoDB URI (throws a warning if MongoDB is running on localhost; throws an error if MongoDB is running on an external instance but the authSource=admin parameter is missing from the URI).\n\n Parses the Horizon licence file to retrieve its expiration date as well as the licence details (number of holders per category).\n\n Network checks\n\n Runs a MongoDB ping on the URI, then checks for the database used in the URI (throws a warning if the database used is not called horizon ; throws an error if no database is specified in the URI).\n\n Checks for AKKA High Availability settings: if no node hostname is set up, skips the remaining HA checks. If 2 nodes are set up, retrieves which node is running the doctor and checks for the other node. If 3 nodes are set up, retrieves which node is running the doctor and checks for the other 2 nodes.\nThe check runs as:\n\n if curl is installed, runs a curl request on the Node hostname at alive on the management port (default is 8558), and if alive runs another curl request on the Node hostname at /ready on the management port. Both requests should return HTTP/200 if ok, 000 otherwise.\n\n if curl is not installed, uses the built-in Linux TCP socket to run TCP SYN checks on both the HA communication port (default is 25520) and the management port (default is 8558) on the Node hostname.\n\n Checks for firewall configuration . Currently only supports firewalld (RHEL) and a netstat test.\n\n The netstat part will run a netstat command to check if the JVM listening socket is active (listening on port 9000). If netstat is not installed, it will skip this test.\n\n The firewalld part will check if the HTTP and HTTPS services are opened in the firewall and if it detected a HA configuration, it will check if the HA ports (both of them) are allowed through the firewalld. If firewalld is not installed or not active, it will skip this test.\n\n Checks if IPv6 is active in every network interface and throws a warning if it is the case (specifying the interface with IPv6 turned on).\n\n TLS checks\n\n Checks for existence and permissions of the Horizon server certificate file: the permissions are expected to be at least 640 and the file is supposed to belong to the nginx group.\n\n Parses the Horizon server certificate file: it should be constituted of the actual TLS server certificate first, then of every certificate of the trust chain (order being leaf to root). It throws a warning if the certificate is self-signed or raises an error if the trust chain has not been imported. It otherwise tries to reconstitute the certificate trust chain via the openssl verify command, and throws an error if it cannot.\n\n Parses the Horizon server certificate file and checks if the Horizon hostname is present in the SAN DNS names of the certificate, throws an error if it is not there.\n\n Log packing option\n\n If the Horizon doctor is launched with the -l option , it will pack the logs of the last 7 days (in /opt/horizon/var/log ) as well as the startup logs (the /var/log/horizon/horizon.log file) and create a tar archive.\n\n The -l option accepts an optional parameter that should be an integer (1-99) and will pack the logs of the last n days instead, as well as the startup logs.\n\n Note that the Horizon doctor will still perform all of its check; the log packing is done at the very end of the program.\n\n Example of call to pack the logs of the last 7 days:\n\n $ horizon-doctor -l\n\n Example of call to pack the logs of the last 30 days:\n\n $ horizon-doctor -l 30\n\n Saving the doctor’s output\n\n If the Horizon doctor is launched with the -o option , it will perform all of its checks and save the output in the specified file instead of displaying it into the stdout (default is the command line interface).\n\n If you use the option, you must provide a filepath in a writable directory.\n\n Example of call to save the output in a file named horizon-doctor.out instead of the stdout:\n\n $ horizon-doctor -o horizon-doctor.out\n\n Help menu\n\n To display Horizon doctor’s help menu, use the -h option.", - "keywords": [ - "horizon", - "doctor", - "install-guide", - "install-guide/iaas/doctor" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:installation:firewall", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Configure the Firewall", - "section": "install-guide", - "slug": "install-guide/iaas/installation/firewall", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/installation/firewall.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/firewall.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Configure the Firewall" - ], - "summary": "Configure the Firewall ⚠ Deprecated: This version reached LDOS on 16/05/2025. Access the server through SSH with an account with administrative privileges; Open port TCP/443 on the local firewall with the following command: $ firewall-cmd -", - "content": "Configure the Firewall\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Access the server through SSH with an account with administrative privileges;\n\n Open port TCP/443 on the local firewall with the following command:\n\n $ firewall-cmd --permanent --add-service=https\n\n Reload the firewall configuration with:\n\n $ systemctl restart firewalld\n\n Install Horizon\n Initial Configuration", - "keywords": [ - "configure", - "the", - "firewall", - "install-guide", - "install-guide/iaas/installation/firewall", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:installation:horizon", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Install Horizon", - "section": "install-guide", - "slug": "install-guide/iaas/installation/horizon", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/installation/horizon.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/horizon.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Install Horizon" - ], - "summary": "Install Horizon ⚠ Deprecated: This version reached LDOS on 16/05/2025. Installation from the EverTrust repository Create a /etc/yum.repos.d/horizon.repo file containing the EverTrust repository info: [horizon] enabled=1 name=Horizon Reposit", - "content": "Install Horizon\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Installation from the EverTrust repository\n\n Create a /etc/yum.repos.d/horizon.repo file containing the EverTrust repository info:\n\n [horizon]\nenabled=1\nname=Horizon Repository\nbaseurl=https://repo.evertrust.io/repository/horizon-rpm/\ngpgcheck=0\nusername=<username>\npassword=<password>\n\n Replace <username> and <password> with the credentials you were provided.\n\n You can then run the following to install the latest Horizon version:\n\n $ yum install horizon\n\n To prevent unattended upgrades when running yum update, you should pin the Horizon version by adding\n\n exclude=horizon\n\n at the end of the /etc/yum.repos.d/horizon.repo file after installing Horizon.\n\n Installing from RPM\n\n Upload the file horizon-2.3.X-1.noarch.rpm through SCP under /root .\n\n Access the server through SSH with an account with administrative privileges;\n\n Install the Horizon package with the following command:\n\n $ yum localinstall /root/horizon-2.3.X-1.noarch.rpm\n\n Installing the Horizon package will install the following dependencies:\n\n dialog\n\n java-11-openjdk-headless\n\n Please note that these packages may have their own dependencies.\n\n Install NGINX\n Configure the Firewall", - "keywords": [ - "install", - "horizon", - "install-guide", - "install-guide/iaas/installation/horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:installation:mongodb", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Install MongoDB", - "section": "install-guide", - "slug": "install-guide/iaas/installation/mongodb", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/installation/mongodb.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/mongodb.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Install MongoDB" - ], - "summary": "Install MongoDB ⚠ Deprecated: This version reached LDOS on 16/05/2025. Mongo DB version 4.2.x to 5.0.x are supported by Horizon Download the latest version of the following Mongo DB 5.x RPMs from the MongoDB web site : mongodb-org mongodb-o", - "content": "Install MongoDB\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\nMongo DB version 4.2.x to 5.0.x are supported by Horizon\n\n Download the latest version of the following Mongo DB 5.x RPMs from the MongoDB web site :\n\n mongodb-org\n\n mongodb-org-mongos\n\n mongodb-org-server\n\n mongodb-org-shell\n\n mongodb-org-tools\n\n Download the last version of the mongosh RPM from the MongoDB GitHub .\n\n mongodb-mongosh\n\n Upload the downloaded RPMs through SCP on the server under /root .\n\n Using an account with privileges, install the RPMs using 'yum'. For example, to install MongoDB version 5.0.1, run the following command from the folder containing the RPMs:\n\n $ yum install mongodb-org*\n$ yum install mongodb-mongosh\n\n Enable the service at startup with the following command:\n\n $ systemctl enable mongod\n\n Start the mongod service with the following command:\n\n $ systemctl start mongod\n\n Verify that you can connect to the Mongo instance by running the mongo shell:\n\n $ mongo\n\nYou can disconnect from the shell with ^D\n\n Pre-requisites\n Install NGINX", - "keywords": [ - "install", - "mongodb", - "install-guide", - "install-guide/iaas/installation/mongodb", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:installation:nginx", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Install NGINX", - "section": "install-guide", - "slug": "install-guide/iaas/installation/nginx", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/installation/nginx.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/nginx.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Install NGINX" - ], - "summary": "Install NGINX ⚠ Deprecated: This version reached LDOS on 16/05/2025. Access the server through SSH with an account with administrative privileges; Install the NGINX web server using the following command: $ yum install nginx Enable NGINX to", - "content": "Install NGINX\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Access the server through SSH with an account with administrative privileges;\n\n Install the NGINX web server using the following command:\n\n $ yum install nginx\n\n Enable NGINX to start at boot using the following command:\n\n $ systemctl enable nginx\n\n Stop the NGINX service with the following command:\n\n $ systemctl stop nginx\n\n Install MongoDB\n Install Horizon", - "keywords": [ - "install", - "nginx", - "install-guide", - "install-guide/iaas/installation/nginx", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:prerequisites", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Pre-requisites", - "section": "install-guide", - "slug": "install-guide/iaas/prerequisites", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/prerequisites.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/prerequisites.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Pre-requisites" - ], - "summary": "Pre-requisites ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section describes the system and software pre-requisites to install Horizon. System pre-requisites The following elements are considered as system pre-requisites: A ", - "content": "Pre-requisites\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section describes the system and software pre-requisites to install Horizon.\n\n System pre-requisites\n\n The following elements are considered as system pre-requisites:\n\n A server running EL [7.x-8.x] x64 (CentOS / RHEL) with the network configured and SELinux disabled;\n\n Base and EPEL CentOS / RHEL [7.x-8.x] x64 repositories activated;\n\n An access with administrative privileges (root) to the server mentioned above;\n\n The IP address / DNS Name of an SMTP relay;\n\n The email address of the Horizon server administrator.\n\n Software pre-requisites\n\n The following elements are considered as software pre-requisites:\n\n The Horizon installation package: horizon-2.3.X-1.noarch.rpm ;\n\n The MongoDB Community Edition package available from the MongoDB web site ;\n\n EPEL repository activated.\n\n As a reminder, EPEL can be activated on CentOS / RHEL by doing the following:\n\n $ yum install epel-release\n\n Introduction\n Install MongoDB", - "keywords": [ - "pre-requisites", - "install-guide", - "install-guide/iaas/prerequisites", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:setup:horizon", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Initial Configuration", - "section": "install-guide", - "slug": "install-guide/iaas/setup/horizon", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/setup/horizon.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/setup/horizon.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Configuration", - "Initial Configuration" - ], - "summary": "Initial Configuration ⚠ Deprecated: This version reached LDOS on 16/05/2025. Configuring the SMTP Relay Access the server through SSH with an account with administrative privileges; Run the Horizon Configuration Utility with the following c", - "content": "Initial Configuration\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Configuring the SMTP Relay\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' SMTP ':\n\n Specify IP address or the DNS name of the SMTP relay and validate:\n\n The Postfix configuration is updated:\n\n Exit the configuration utility and restart the Postfix service with the following command:\n\n $ systemctl restart postfix\n\n Configuring the Horizon Administrator’s Email Address\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select Administrator :\n\n Specify the email address of the Horizon Administrator and validate:\n\n Exit the Configuration Utility;\n\n Validate the SMTP relay and Administrator Email Address with the following commands:\n\n $ yum install mailx\n$ mail -s \"Hello Horizon root\"\n > Hello From Horizon\n .\n\n Ensure that the email receives the test email.\n\n Generating a new Horizon Application Secret\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $/opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Akka_Play ':\n\n In the Akka_Play menu, select ' SECRET ':\n\n Validate the new Horizon Application Secret:\n\n The Horizon configuration is updated:\n\n JVM Configuration\n\n Horizon allows you to configure the xms (minimum memory allocation pool) and xmx (maximum memory allocation pool) parameters of the JVM running Horizon using the configuration tool.\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the configuration menu, select ' Horizon ':\n\n In the Horizon configuration menu, Select ' JVM ':\n\n Specify the 2048 for xms and 3072 for xmx parameters and select ' OK ':\n\n The new JVM parameters are configured:\n\n MongoDB URI Configuration\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select Horizon :\n\n In the Horizon configuration menu, Select MONGODB_URI :\n\n Specify the MongoDB URI to target your MongoDB instance:\n\n Horizon is installed to target a local MongoDB instance by default.\n\n If you use an external MongoDB (such as MongoDB Atlas Database or dedicated On-premises database) instance:\n\n Create a user with \"read/write\" permissions on your MongoDB instance;\n\n Create a replicaSet if using a MongoDB cluster;\n\n Specify a MongoDB URI that does match your context.\n\n External MongoDB database URI syntax:\n mongodb+srv://<user>:<password>@<Mongo-DB-hostname>:<Mongo-DB-Port>/horizon\n\n External MongoDB cluster of databases URI syntax:\n mongodb+srv://<user>:<password>@<Mongo-DB-hostname-1>,<Mongo-DB-hostname-2>:<Mongo-DB-Port>/horizon?replicaSet=<Horizon-ReplicaSet-Name>&authSource=admin\n\n The MongoURI is configured:\n\n Horizon Hostname Configuration\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon configuration menu, select HORIZON_HOSTNAME :\n\n Specify the DNS FQDN by which Horizon will be accessed:\n\n The Horizon Hostname is configured:\n\n Generating an event seal secret\n\n Horizon will generate functional events when using the software.\n\n These events are typically signed and chained to ensure their integrity. Therefore, you must specify a sealing secret for this feature to work correctly.\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon menu, select ' HORIZON_SEAL_SECRET ':\n\n Validate the new event seal secret:\n\n The event seal secret is now configured :\n\n Installing the Horizon license\n\n You should have been provided with a ' horizon.lic ' file. This file is a license file and indicates:\n\n The horizon entitled module(s)\n\n The limitation in terms of holder per module if any\n\n A end of support date\n\n Upload the horizon.lic file through SCP under /tmp/horizon.lic ;\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon configuration menu, Select ' HORIZON_LICENSE ':\n\n Specify the path /tmp/horizon.lic and validate:\n\n The Horizon License is configured:\n\n Restart the horizon service using the following command:\n\n $ systemctl restart horizon\n\n Horizon Vault Key configuration\n\n Horizon stored sensitive data in a secure way using encryption.\n\n Horizon masterkey can be derived from:\n\n Software key;\n\n HSM stored key using (PKCS#11 compatible HSMs are supported);\n\n Azure Key Vault stored key;\n\n Hashicorp vault stored key;\n\n FCMS vault stored key.\n\n Please refer to the proper section according to your setup.\n\n Horizon SSV key Configuration (Software)\n\nThis section must not be followed if you use another vault than the default one.\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon configuration menu, Select ' HORIZON_SSV_KEY ':\n\n Specify the master key that will be used:\n\n Horizon masterkey is configured:\n\n Restart the horizon service using the following command:\n\n $ systemctl restart horizon\n\n HSM vault Configuration\n\n Horizon supports PKCS#11 compatible HSM vaults .\n\nThis section must not be followed if you use another vault than the HSM vault.\n\n HSM middleware should be properly installed and HSM slot initialization should be done using the tools provided by the HSM provider.\n\"horizon\" linux user should be member of the proper HSM linux management group to perform cryptographic operations ('nfast' for nCipher nShield HSM or 'hsmusers' for Luna HSM for example).\n\n Access the server through SSH with an account with administrative privileges;\n\n Create a vaults.conf configuration file in /opt/horizon/etc/conf.d directory with the following content to configure the HSM vault:\n\n default {\n module_path = \"\"\n slot_id = \"\"\n pin = \"\"\n label = \"\"\n allow_master_key_gen = true\n}\n\n module_path : The path to the PKCS#11 library (string between double quotes);\n\n slot_id : ID of the Slot on the PKCS#11 Module (string between double quotes);\n\n pin : The PIN used to authenticate to your HSM slot (string between double quotes);\n\n label : Label of key (string between double quotes);\n\n allow_master_key_gen : Allow the masterkey to be generated by Horizon if not found in the slot.\n\n Set the permissions using the following commands:\n\n $ chown horizon:horizon /opt/horizon/etc/conf.d/vaults.conf\n\n Restart the horizon service using the following command:\n\n $ systemctl restart horizon\n\n At the end of the installation procedure:\n\n Set allow_master_key_gen value to false .\n\n Restart the horizon service.\n\n Installing Horizon on a cluster of servers\n\nThis section must not be followed if you plan on deploying Horizon in standalone mode (vs cluster mode).\nWARNING: This section does not explain how to install Horizon on a Kubernetes cluster. Please refer to the dedicated section.\n\n In the main menu, select ' Akka_Play ':\n\n In the Akka_Play menu, select ' AKKA_HA ':\n\n In this menu, specify either the IP address or the DNS name for each server that will be running Horizon on this cluster, as well as the local node index (the number of the node that you are configuring at that moment).\n\n Note that the local node index must match the Node Hostname parameter:\n\n Save your changes from the menu.\n\n The High Availability mode is now configured on the current node :\n\n You must now configure your other nodes, but because they belong to the same cluster they need to share the same secret, the same secret seal event, the same hostname and the same database .\nIn order to be able to do that, you need to copy the configuration file that was generated by the horizon-config app, named /etc/default/horizon and paste it on each one of your nodes;\n\n Then on each other node, run the Horizon Configuration utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the Akka_Play menu, select ' AKKA_HA ':\n\n Here, you need to change the local node index to match the hostname of the node that you are configuring:\n\nYou will need to import the Horizon licence file on each node manually, following the guidelines of section Installing the Horizon license .\n\n Additionally, on each node, you will need to open the ports used for Akka_HA and Akka_MGMT, which are by default 25520 and 8558:\n\n $ firewall-cmd --permanent --add-port=25520/tcp\n$ firewall-cmd --permanent --add-port=8558/tcp\n\n Reload the firewall configuration with:\n\n $ systemctl restart firewalld\n\n Restart the Horizon service on each one of the nodes:\n\n $ systemctl restart horizon\n\n Configure the Firewall\n Server Authentication Certificate", - "keywords": [ - "initial", - "configuration", - "install-guide", - "install-guide/iaas/setup/horizon", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:setup:nginx", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Server Authentication Certificate", - "section": "install-guide", - "slug": "install-guide/iaas/setup/nginx", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/setup/nginx.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/setup/nginx.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Configuration", - "Server Authentication Certificate" - ], - "summary": "Server Authentication Certificate ⚠ Deprecated: This version reached LDOS on 16/05/2025. Issuing a Certificate Request (PKCS#10) Access the server through SSH with an account with administrative privileges. Run the Horizon Configuration Uti", - "content": "Server Authentication Certificate\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Issuing a Certificate Request (PKCS#10)\n\n Access the server through SSH with an account with administrative privileges.\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' NGINX ':\n\n In the NGINX menu, select ' CSR ':\n\n Specify the DNS Name of the Horizon server (by default, the config script takes the Horizon hostname if defined or the local machine hostname otherwise):\n\n The certificate request is generated and available under /etc/nginx/ssl/horizon.csr.new :\n\n Sign the certificate request using your PKI.\n\n Installing a Server Certificate\n\n Upload the generated server certificate on the Horizon server under /tmp/horizon.pem through SCP;\n\n In the NGINX configuration menu, select ' CRT ':\n\n Specify the path /tmp/horizon.pem and validate:\n\n The server certificate is successfully installed:\n\n Installing the Server Certificate Trust Chain\n\n Upload the server certificate trust chain (the concatenation of the Certificate Authority certificates in PEM format) on the Horizon server under /tmp/server.bundle through SCP;\n\n In the NGINX configuration menu, select ' TC ':\n\n Specify the path /tmp/server.bundle and validate:\n\n The server bundle is successfully installed:\n\n Verify the NGINX configuration with the following command:\n\n $ nginx -t\n\n Restart the NGINX service with the following command:\n\n $ systemctl restart nginx\n\n Initial Configuration\n Initial Horizon access", - "keywords": [ - "server", - "authentication", - "certificate", - "install-guide", - "install-guide/iaas/setup/nginx", - "horizon", - "installation", - "installing", - "on", - "centos/rhel", - "configuration" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:uninstall", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Uninstallation", - "section": "install-guide", - "slug": "install-guide/iaas/uninstall", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/uninstall.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/uninstallation.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Uninstallation" - ], - "summary": "Uninstallation ⚠ Deprecated: This version reached LDOS on 16/05/2025. Before uninstalling, please make sure that you have a proper backup of the Horizon component . Once uninstalled, all the Horizon data will be irremediably lost ! Uninstal", - "content": "Uninstallation\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\nBefore uninstalling, please make sure that you have a proper backup of the Horizon component . Once uninstalled, all the Horizon data will be irremediably lost !\n\n Uninstalling Horizon consists in uninstalling:\n\n The Horizon service;\n\n The MongoDB service;\n\n The NGINX service.\n\n Uninstalling Horizon\n\n Access the server through SSH with an account with administrative privileges.\n\n Uninstall Horizon with the following commands:\n\n $ systemctl stop horizon\n$ yum remove horizon\n$ rm -rf /opt/horizon\n$ rm -rf /var/log/horizon\n$ rm -f /etc/default/horizon\n\n Uninstalling NGINX\n\n Access the server through SSH with an account with administrative privileges.\n\n Uninstall NGINX with the following commands:\n\n $ systemctl stop nginx\n$ yum remove nginx\n$ rm -rf /etc/nginx\n$ rm -rf /var/log/nginx\n\n Uninstalling MongoDB\n\n Access the server through SSH with an account with administrative privileges.\n\n Uninstall MongoDB with the following commands:\n\n $ systemctl stop mongod\n$ rpm -qa | grep -i mongo | xargs rpm -e\n$ rm -rf /var/log/mongodb\n$ rm -rf /var/lib/mongodb\n\n Backup and Restore\n Installation", - "keywords": [ - "uninstallation", - "install-guide", - "install-guide/iaas/uninstall", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:upgrade:2.1.0", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Upgrading from a version prior to 2.1.0", - "section": "install-guide", - "slug": "install-guide/iaas/upgrade/2.1.0", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/upgrade/2.1.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.6/install-guide/iaas/upgrade/2.1.0.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Upgrade", - "Upgrading from a version prior to 2.1.0" - ], - "summary": "Upgrading from a version prior to 2.1.0 ⚠ Deprecated: This version reached LDOS on 16/05/2025. These instructions are specific to the 2.1.0 version, and should be followed if you upgrade from a version prior to 2.1.0 to any version greater ", - "content": "Upgrading from a version prior to 2.1.0\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n These instructions are specific to the 2.1.0 version, and should be followed if you upgrade from a version prior to 2.1.0 to any version greater or equal to 2.1.0.\n\n These steps should be followed in addition to the common upgrade procedure found in Standard Upgrade . None of these steps are automated by horizon-upgrade .\n\n Setting an event seal secret\n\n You must manually create an entry to pass an event seal secret to Horizon in the /etc/default/horizon file. horizon-config won’t do that automatically.\n\n To do so, open the /etc/default/horizon file with a text editor:\n\n $ vi /etc/default/horizon\n\n And add a new line under the Horizon variables section:\n\n # Horizon variables\nHORIZON_NOTIFICATION_SMTP_HOST=127.0.0.1\nHORIZON_HOSTNAME=\nHORIZON_DEFAULT_SSV_KEY=\nHORIZON_EVENT_SEAL_SECRET=changeme # <- this one\n\n Then, near the end of the file, after the # Setting Horizon Mongo DB uri section, create a new section for the event seal secret:\n\n # Setting the Horizon event seal secret\nJAVA_OPTS=\"$JAVA_OPTS -Dhorizon.event.seal.secret=${HORIZON_EVENT_SEAL_SECRET}\"\n\n Horizon won’t boot if the HORIZON_EVENT_SEAL_SECRET is set to changeme . Therefore, you should set your secret to something hard to guess.\nRefer to the Initial Configuration guide to learn how to generate a seal secret with horizon-config .\n\n Standard Upgrade\n Backup and Restore", - "keywords": [ - "upgrading", - "from", - "version", - "prior", - "to", - "install-guide", - "install-guide/iaas/upgrade/2", - "horizon", - "installation", - "installing", - "on", - "centos/rhel", - "upgrade" - ] - }, - { - "page_id": "horizon:2.3:install-guide:iaas:upgrade:upgrade", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Standard Upgrade", - "section": "install-guide", - "slug": "install-guide/iaas/upgrade/upgrade", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/iaas/upgrade/upgrade.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.6/install-guide/iaas/upgrade/upgrade.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Upgrade", - "Standard Upgrade" - ], - "summary": "Standard Upgrade ⚠ Deprecated: This version reached LDOS on 16/05/2025. The current instructions refer to the standard upgrade procedure. Additional steps might be required, please refer to release notes. Upgrade the horizon installation Yo", - "content": "Standard Upgrade\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n The current instructions refer to the standard upgrade procedure.\nAdditional steps might be required, please refer to release notes.\n\n Upgrade the horizon installation\n\n You must retrieve the latest Horizon RPM from the EverTrust repository manually using the user credentials you were provided.\n\n Access the server through SSH with an account with administrative privileges.\n\n Install the Horizon package with the following command:\n\n $ yum install horizon-2.3.X-1.noarch.rpm\n\n Upgrade the database schema\n\n Some Horizon versions require that you run migration scripts against your database.\nSince version 2.1.0, Horizon comes bundled with an horizon-upgrade script that handles this migration logic.\n\n Therefore, after each upgrade, you should run horizon-upgrade to check whether new migrations should be run.\n\n Access the server through SSH with an account with administrative privileges.\n\n Run the following command:\n\n $ /opt/horizon/sbin/horizon-upgrade -t <target version>\n\n In most cases, horizon-upgrade can detect the version you’re upgrading from by checking the database. However, when upgrading from version prior to 2.1.0, you will encounter the following error:\n\n *** Unable to infer the source version from your database. Specify it explicitly with the -s flag. ***\n\n You’ll have to explicitly tell horizon-upgrade which version you are upgrading from. To do that, simply set the source version explicitly with the -s flag:\n\n $ /opt/horizon/sbin/horizon-upgrade -t <target version> -s <source version>\n\n Similarly, horizon-upgrade will try to use the MongoDB URI that was configured by the Horizon configuration utility. If it fails to auto-detect your database URI or you wish to migrate another database, specify the URI explicitly using the -m flag:\n\n $ /opt/horizon/sbin/horizon-upgrade -t <target version> -m \"<mongo uri>\"\n\n The upgrade script requires a MongoDB client to connect to your database (either mongo or mongosh ). If no client is installed on the host where Horizon is running, consider installing the standalone mongosh client or running the upgrade script from another host that has access to the database.\n\n Initial Horizon access\n Upgrading from a version prior to 2.1.0", - "keywords": [ - "standard", - "upgrade", - "install-guide", - "install-guide/iaas/upgrade/upgrade", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.3:install-guide:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Introduction", - "section": "install-guide", - "slug": "install-guide/introduction", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/introduction.html", - "breadcrumbs": ["Horizon", "Installation", "Introduction"], - "summary": "Introduction ⚠ Deprecated: This version reached LDOS on 16/05/2025. Description Horizon is EverTrust Certificate lifecycle management solution. This document is an installation procedure detailing how to install and bootstrap Horizon server", - "content": "Introduction\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Description\n\n Horizon is EverTrust Certificate lifecycle management solution. This document is an installation procedure detailing how to install and bootstrap Horizon server on your infrastructure. It does not describe how to configure and operate a Horizon instance. Please refer to the administration guide for administration related tasks.\n\n Prerequisites\n\n Choose an installation method\n\n We offer two installation modes:\n\n A package-based installation on a server running CentOS/RHEL 7.x/8.x x64\n\n A cloud-native installation using Kubernetes\n\n Depending on your needs, you’ll have to choose the solution that fits your use cases the best. Reach out to our support team to get suggestions on how to deploy on your infrastructure.\n\n Gathering your credentials\n\n Both methods require that you download the binaries of the Horizon software from our software repository . The access to this repository is protected by username and password, which you should have got from our tech team. If you don’t, you won’t be able to continue with the installation. Email us to get your credentials, and come back to this step.\n\n Pre-requisites", - "keywords": [ - "introduction", - "install-guide", - "install-guide/introduction", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.3:install-guide:k8s:advanced", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Advanced usage", - "section": "install-guide", - "slug": "install-guide/k8s/advanced", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/k8s/advanced.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/k8s/advanced.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Advanced usage" - ], - "summary": "Advanced usage ⚠ Deprecated: This version reached LDOS on 16/05/2025. Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes. You may find some of them below. Running behind a Docke", - "content": "Advanced usage\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes. You may find some of them below.\n\n Running behind a Docker registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images.\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use a CRD (Custom Resource Definition) named Lease ( akka.io/v1/leases ). We strongly recommend that you use this mechanism, however it implies that you have the necessary permissions to install CRDs onto your server. In case you don’t, the feature can be disabled by passing the --skip-crds flag to the Helm command when installing the chart, and setting the leases.enabled key to false .\nIf you want to manually install the CRD, you can check the crds/leases.yml file.\n\n Injecting extra configuration\n\n Extra Horizon configuration can be injected to the bundled application.conf file to modify low-level behavior of Horizon. This should be used carefully as it may cause things to break. To do so, just mount a folder in the Horizon container at /horizon/etc/conf.d/ containing a custom.conf file.\n\n This can be done with the following edits to your values.yaml file :\n\n extraVolumes:\n - name: additional-config\n configMap:\n name: additional-config\n\nextraVolumeMounts:\n - name: additional-config\n mountPath: /horizon/etc/conf.d\n\n Where the additional-config configmap contains a single key with your custom configuration :\n\n apiVersion: v1\nkind: ConfigMap\ndata:\n custom.conf: |-\n play.server.http.port = 9999\n\n Extra configurations are included at the end of the config file, overriding any previously set config value.\n\n Manual ingress configuration\n\n If you do not wish or cannot use autoconfiguration, you should ensure your ingress controller is correctly configured to enable all Horizon features.\n\n When requiring client certificates for authentication, the web server should not perform checks to validate that the certificate is signed by a trusted CA. Instead, the certificate should be sent to Horizon through a request header, base64-encoded. The header name used can be controlled using the clientCertificateHeader .\n\n Some endpoints should not be server over HTTPS, and some should always ask for a client certificate. Refer to the matrix below to understand how to correctly configure your ingress controller to enjoy a full-featured Horizon install.\n\n Enrollment protocol\n Endpoints\n Expected behavior\n\n SCEP\n\n /scep\n\n /certsrv\n\n /certSrv\n\n /intune\n\n /jamf\n\n Never ask for a client certificate. Serve over both HTTP (preferably supporting 1.0) and HTTPS.\n\n EST\n\n /.well-known/est\n\n Always ask for an optional client certificate.\n\n ACME\n\n /acme\n\n Never ask for a client certificate.\n\n WCCE\n\n /api/v1/wcce\n\n Always ask for an optional client certificate.\n\n -\n\n *\n\n May ask for a client certificate if requested by the user.\n\n Uninstallation\n Installing with Docker", - "keywords": [ - "advanced", - "usage", - "install-guide", - "install-guide/k8s/advanced", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.3:install-guide:k8s:installation", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Installation", - "section": "install-guide", - "slug": "install-guide/k8s/installation", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/k8s/installation.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/k8s/installation.html", - "breadcrumbs": ["Horizon", "Installation", "Installing on Kubernetes"], - "summary": "Installation ⚠ Deprecated: This version reached LDOS on 16/05/2025. Concepts overview In Kubernetes, applications are deployed onto Pods , which represents a running version of a containerized application. Pods are grouped by Deployments , ", - "content": "Installation\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Concepts overview\n\n In Kubernetes, applications are deployed onto Pods , which represents a running version of a containerized application. Pods are grouped by Deployments , which represent a set of Pods running the same application. For instance, should you need to run Horizon in high availability mode, your deployment will contain 3 pods or more. Applications running in Pods are made accessible by a Service , which grants a set of Pods an IP address (which can either be internal to the cluster or accessible on the public Internet through a Load Balancer).\n\n The recommended way of installing on Horizon is through the Horizon’s Helm Chart. Helm is a package manager for Kubernetes that will generate Kubernetes resources necessary to deploy Horizon onto your cluster. The official Helm Chart will generate a deployment of one or more Pods running Horizon on your cluster.\n\n Setting up Helm repository\n\n Now that the application secrets are configured, add the EverTrust Helm repository to your machine:\n\n $ helm repo add evertrust https://repo.evertrust.io/repository/charts\n\n Verify that you have access to the Chart :\n\n $ helm search repo evertrust/horizon\nNAME CHART VERSION\tAPP VERSION\tDESCRIPTION\nevertrust/horizon 0.5.8 2.3.4 EverTrust Horizon Helm chart\n\n Configuring the namespace\n\n For isolation purposes, we strongly recommend that you create a dedicated namespace for Horizon :\n\n $ kubectl create namespace horizon\n\n The namespace should be empty. In order to run Horizon, you’ll need to create two secrets in that namespace:\n\n A license secret containing your Horizon license file\n\n An image pull secret, allowing Kubernetes to authenticate to the EverTrust’s container repository\n\n Creating the license secret\n\n You should have a license file for your Horizon installation, most probably named horizon.lic . To convert this file to a Kubernetes secret, run:\n\n $ kubectl create secret generic horizon-license \\\n --from-file=license=\"<path to your license file>\" \\\n --namespace horizon\n\n Creating the image pull secret\n\n Next, you should configure Kubernetes to authenticate to the EverTrust repository using your credentials. They are necessary to pull the Horizon docker image, you should have received them upon purchase. Get your username and password and create the secret:\n\n $ kubectl create secret docker-registry evertrust-registry \\\n --docker-server=registry.evertrust.io \\\n --docker-username=\"<your username>\" \\\n --docker-password=\"<your password>\" \\\n --namespace horizon\n\n Configuring the chart\n\n You’ll next need to override the defaults values.yaml file of the Helm Chart to reference the secrets that we’ve created. We’ll provide a minimal configuration for demonstration purposes, but please do follow our production setup guide before deploying for production.\n\n Create a override-values.yaml file somewhere and paste this into the file:\n\n image:\n pullSecrets:\n - evertrust-registry\n\nlicense:\n secretName: horizon-license\n secretKey: license\n\n To finish Horizon’s installation, simply run the following command:\n\n $ helm install horizon evertrust/horizon -f override-values.yaml -n horizon\n\n Please allow a few minutes for the Horizon instance to boot up. You are now ready to go on with the First login .\nThis instance will allow you to test out if Horizon is working correctly on your cluster. However, this installation is not production-ready. Follow our Production checklist to make sure your instance is fit to run in your production environment.\n\n Uninstallation\n Production checklist", - "keywords": [ - "installation", - "install-guide", - "install-guide/k8s/installation", - "horizon", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.3:install-guide:k8s:production", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Production checklist", - "section": "install-guide", - "slug": "install-guide/k8s/production", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/k8s/production.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/k8s/production.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Production checklist" - ], - "summary": "Production checklist ⚠ Deprecated: This version reached LDOS on 16/05/2025. Even though the Helm Chart makes installing Horizon a breeze, you’ll still have to set up a few things to make Horizon resilient enough to operate in a production e", - "content": "Production checklist\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Even though the Helm Chart makes installing Horizon a breeze, you’ll still have to set up a few things to make Horizon resilient enough to operate in a production environment.\n\n Operating the database\n\n All persistent data used by Horizon is stored in the underlying MongoDB database. Therefore, the database should be operated securely and backed up regularly.\n\n When installing the chart, you face multiple options regarding your database:\n\n By default, a local MongoDB standalone instance will be spawned in your cluster, using the bitnami/mongodb chart. No additional configuration is required but it is not production ready out of the box. You can configure the chart as you would normally below the mongodb key :\n\n mongodb:\n architecture: replicaset\n # Any other YAML value from the chart docs\n\n If you want to use an existing MongoDB instance, provide the externalDatabase.uri value. The URI should be treated as a secret as it must include credentials:\n\n externalDatabase:\n uri:\n valueFrom:\n secretKeyRef:\n name: <secret name>\n key: <secret key>\n\n The chart doesn’t manage the database. You are still in charge of making sure that the database is correctly backed up. You could either back up manually using mongodump or use a managed service such as MongoDB Atlas , which will take care of the backups for you.\n\n Managing secrets\n\n Storing secrets is a crucial part of your Horizon installation. On cloud-native installations like on Kubernetes, we recommend using SSV (Secure Software Vault) to encrypt sensitive data : a master passphrase will be used to encrypt and decrypt data before they enter the database. Alongside with other application secrets like your MongoDB URI (containing your credentials or certificate).\nWe recommend that you create Kubernetes secrets beforehand or inject them directly into the pod.\n\n Values that should be treated as secrets in this chart are:\n\n Name\n Description\n Impact on loss\n\n vaults.*.master_password\n\n SSV password used to encrypt sensitive data in database.\n\n Highest impact: database would be unusable\n\n events.secret\n\n Secret used to sign and chain events.\n\n Moderate impact: events integrity would be unverifiable\n\n externalDatabase.uri\n\n External database URI, containing a username and password.\n\n Low impact: reset the MongoDB password\n\n appSecret\n\n Application secret use to encrypt session data.\n\n Low impact: sessions would be reset\n\n mailer.password\n\n SMTP server password\n\n Low impact: reset the SMTP password\n\n For each of these values, either :\n\n leave the field empty, so that a secret will be automatically generated.\n\n derive the secret value from an existing Kubernetes secret:\n\n appSecret:\n valueFrom:\n secretKeyRef:\n name: <secret name>\n key: <secret key>\n\nAlways store auto-generated secrets in a safe place after they’re generated. If you ever uninstall your Helm chart, the deletion of the SSV secret will lead to the impossibility of recovering most of your data.\n\n High availability\n\n By default, the chart will configure a single-pod deployment. This deployment method is fine for testing but not ready for production as a single failure could take down the entire application. Instead, we recommend that you set up a Horizon cluster using at least 3 pods.\n\n In order to do that, configure an horizontalAutoscaler in your override-values.yaml file:\n\n horizontalAutoscaler:\n enabled: true\n minReplicas: 3\n maxReplicas: 3\n\nUse nodeAffinity to spread your Horizon cluster Pods among multiple nodes in different availability zones to reduce the risk of Single Point of Failure.\n\n Configuring ingresses\n\n To create an ingress upon installation, simply set the following keys in your override-values.yaml file:\n\n ingress:\n enabled: true\n hostname: horizon.lab\n tls: true\n\n We support autoconfiguration for major ingress controllers : Kubernetes Ingress NGINX and Traefik. Autoconfiguration is the recommended way of configuring your ingress as it will handle configuration quirks for you. To enable autoconfiguration, set the type key to your ingress controller in the ingress definition. Accepted values are nginx and traefik .\n\n ingress:\n enabled: true\n type: \"\" # nginx or traefik\n clientCertificateAuth: true\n hostname: horizon.lab\n tls: true\n\n clientCertificateAuth can be used to control whether to ask for a client certificates when users access Horizon.\n\n If you wish to manually configure your ingress or use another ingress controller, head to the Manual ingress configuration section.\n\n Manual ingress configuration\n\n If you do not wish or cannot use autoconfiguration, you should ensure your ingress controller is correctly configured to enable all Horizon features.\n\n When requiring client certificates for authentication, the web server should not perform checks to validate that the certificate is signed by a trusted CA. Instead, the certificate should be sent to Horizon through a request header, base64-encoded. The header name used can be controlled using the clientCertificateHeader .\n\n Some endpoints should not be server over HTTPS, in particular those used for SCEP enrollment. You may want to create an HTTP-only ingress for serving paths prefixed by /scep and /certsrv , and prevent those from redirecting to HTTPS.\n\n Installation\n Upgrade", - "keywords": [ - "production", - "checklist", - "install-guide", - "install-guide/k8s/production", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.3:install-guide:k8s:uninstall", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Uninstallation", - "section": "install-guide", - "slug": "install-guide/k8s/uninstall", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/k8s/uninstall.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/uninstallation.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Uninstallation" - ], - "summary": "Uninstallation ⚠ Deprecated: This version reached LDOS on 16/05/2025. To uninstall Horizon from your cluster, simply run : $ helm uninstall horizon -n horizon This will uninstall Horizon. If you installed a local MongoDB instance through th", - "content": "Uninstallation\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n To uninstall Horizon from your cluster, simply run :\n\n $ helm uninstall horizon -n horizon\n\n This will uninstall Horizon. If you installed a local MongoDB instance through the Horizon’s chart, it will also be uninstalled, meaning you’ll lose all data from the instance.\n\nBefore uninstalling Horizon, if you wish to keep your database, please back up your application secrets (in particular the SSV secret). Without it, you won’t be able to decrypt your database and it will become useless.\n\n Upgrade\n Advanced usage", - "keywords": [ - "uninstallation", - "install-guide", - "install-guide/k8s/uninstall", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.3:install-guide:k8s:upgrade", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Upgrade", - "section": "install-guide", - "slug": "install-guide/k8s/upgrade", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/k8s/upgrade.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/upgrade.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Upgrade" - ], - "summary": "Upgrade ⚠ Deprecated: This version reached LDOS on 16/05/2025. We recommended that you only change values you need to customize in your values.yml file to ensure smooth upgrading. Always check the upgrading instructions between chart versio", - "content": "Upgrade\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n We recommended that you only change values you need to customize in your values.yml file to ensure smooth upgrading.\nAlways check the upgrading instructions between chart versions.\n\n Upgrading the chart\n\n When upgrading Horizon, you’ll need to pull the latest version of the chart :\n\n $ helm repo update evertrust\n\n Verify that you now have the latest version of Horizon (through the App version column) :\n\n $ helm search repo evertrust/horizon\nNAME CHART VERSION\tAPP VERSION\tDESCRIPTION\nevertrust/horizon 0.5.8 2.3.4 EverTrust Horizon Helm chart\n\n Launch an upgrade by specifying the new version of the chart through the --version flag in your command :\n\n $ helm upgrade <horizon> evertrust/horizon \\\n --values override-values.yaml \\\n --version 0.5.8\n\n The chart will automatically create a Job that runs an upgrade script when it detects that the Horizon version has changed between two releases. If the upgrade job fails to run, check the job’s pod logs. When upgrading from an old version of Horizon, you may need to explicitly specify the version you’re upgrading from using the upgrade.from key.\n\nBefore upgrading to specific chart version, thoroughly read any Specific chart upgrade instructions for your version.\n\n Specific chart upgrade instructions\n\n Upgrading to 0.3.0\n\n Loggers are now configured with an array instead of a dictionary. Check the values.yaml format and update your override values.yaml accordingly.\n\n The init database parameters ( initDatabase , initUsername and initPassword ) have been renamed and moved to mongodb.horizon .\n\n Upgrading to 0.5.0\n\n The ingress definition has changed. The rules and tls keys have been removed in favor of a more user-friendly hostname that will autoconfigure the ingress rules, and a boolean tls key that will enable TLS on that ingress. Check the Ingress section.\n\n Production checklist\n Uninstallation", - "keywords": [ - "upgrade", - "install-guide", - "install-guide/k8s/upgrade", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.3:install-guide:troubleshooting", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Troubleshooting", - "section": "install-guide", - "slug": "install-guide/troubleshooting", - "url": "https://docs.evertrust.fr/horizon/2.3/install-guide/troubleshooting.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/troubleshooting.html", - "breadcrumbs": ["Horizon", "Installation", "Troubleshooting"], - "summary": "Troubleshooting ⚠ Deprecated: This version reached LDOS on 16/05/2025. Horizon Doctor Horizon doctor is a tool that performs checks on your Horizon installation as well as its required dependencies to ensure that everything is configured pr", - "content": "Troubleshooting\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Horizon Doctor\n\n Horizon doctor is a tool that performs checks on your Horizon installation as well as its required dependencies to ensure that everything is configured properly.\nThe tool is targeted towards troubleshooting during installation or update procedures.\nNote that the tool requires root permissions to run.\n\n Performed checks\n\n At the moment, Horizon Doctor checks for:\n\n OS checks\n\n Checks for installed Horizon version, MongoDB version, Java version, Nginx version, OS Version.\n\n If the OS is a RedHat distribution, checks if the RedHat subscription is active\n\n If Mongo is not installed locally, it notices it as an information log\n\n Checks for SELinux 's configuration : throws a warning if it is enabled, says ok if it is on permissive or disabled\n\n Checks for the status of the necessary services: postfix , mongod , nginx and horizon .\n\n If the postfix service is running, tries to connect via a TCP SYN on the port 25 of the relayhost specified in the /etc/postfix/main.cf file and throws an error if it can’t.\n\n Checks how long the Horizon service has been running for.\n\n Checks if there is an NTP service active on the machine and checks if the system clock is synchronized with the NTP service.\n\n Config checks\n\n Checks for existence and permissions of the configuration file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon\n\n Checks for existence and permissions of the licence file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for existence and permissions of the vault file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for the permission of the Horizon directory (default: /opt/horizon): the permission is expected to be at least 755.\n\n Checks for the existence of the symbolic link for nginx configuration and runs an nginx -t test.\n\n Retrieves the Java heap size parameters that were set for Horizon and throws a warning if the default ones are used (min = 2048 and max = 3072).\n\n Retrieves the Horizon DNS hostname and stores it for a later test (throws an error if it has not been set).\n\n Checks for the Horizon Play Secret and Horizon Event Seal Secret : these are the Horizon application secrets and should be different from default value thus Horizon Doctor throws an error if either of them is equal to the default value ( changeme ).\n\n Retrieves the MongoDB URI (throws a warning if MongoDB is running on localhost; throws an error if MongoDB is running on an external instance but the authSource=admin parameter is missing from the URI).\n\n Parses the Horizon licence file to retrieve its expiration date as well as the licence details (number of holders per category).\n\n Network checks\n\n Runs a MongoDB ping on the URI, then checks for the database used in the URI (throws a warning if the database used is not called horizon ; throws an error if no database is specified in the URI).\n\n Checks for AKKA High Availability settings: if no node hostname is set up, skips the remaining HA checks. If 2 nodes are set up, retrieves which node is running the doctor and checks for the other node. If 3 nodes are set up, retrieves which node is running the doctor and checks for the other 2 nodes.\nThe check runs as:\n\n if curl is installed, runs a curl request on the Node hostname at alive on the management port (default is 8558), and if alive runs another curl request on the Node hostname at /ready on the management port. Both requests should return HTTP/200 if ok, 000 otherwise.\n\n if curl is not installed, uses the built-in Linux TCP socket to run TCP SYN checks on both the HA communication port (default is 25520) and the management port (default is 8558) on the Node hostname.\n\n Checks for firewall configuration . Currently only supports firewalld (RHEL) and a netstat test.\n\n The netstat part will run a netstat command to check if the JVM listening socket is active (listening on port 9000). If netstat is not installed, it will skip this test.\n\n The firewalld part will check if the HTTP and HTTPS services are opened in the firewall and if it detected a HA configuration, it will check if the HA ports (both of them) are allowed through the firewalld. If firewalld is not installed or not active, it will skip this test.\n\n Checks if IPv6 is active in every network interface and throws a warning if it is the case (specifying the interface with IPv6 turned on).\n\n TLS checks\n\n Checks for existence and permissions of the Horizon server certificate file: the permissions are expected to be at least 640 and the file is supposed to belong to the nginx group.\n\n Parses the Horizon server certificate file: it should be constituted of the actual TLS server certificate first, then of every certificate of the trust chain (order being leaf to root). It throws a warning if the certificate is self-signed or raises an error if the trust chain has not been imported. It otherwise tries to reconstitute the certificate trust chain via the openssl verify command, and throws an error if it cannot.\n\n Parses the Horizon server certificate file and checks if the Horizon hostname is present in the SAN DNS names of the certificate, throws an error if it is not there.\n\n Log packing option\n\n If the Horizon doctor is launched with the -l option , it will pack the logs of the last 7 days (in /opt/horizon/var/log ) as well as the startup logs (the /var/log/horizon/horizon.log file) and create a tar archive.\n\n The -l option accepts an optional parameter that should be an integer (1-99) and will pack the logs of the last n days instead, as well as the startup logs.\n\n Note that the Horizon doctor will still perform all of its check; the log packing is done at the very end of the program.\n\n Example of call to pack the logs of the last 7 days:\n\n $ horizon-doctor -l\n\n Example of call to pack the logs of the last 30 days:\n\n $ horizon-doctor -l 30\n\n Saving the doctor’s output\n\n If the Horizon doctor is launched with the -o option , it will perform all of its checks and save the output in the specified file instead of displaying it into the stdout (default is the command line interface).\n\n If you use the option, you must provide a filepath in a writable directory.\n\n Example of call to save the output in a file named horizon-doctor.out instead of the stdout:\n\n $ horizon-doctor -o horizon-doctor.out\n\n Help menu\n\n To display Horizon doctor’s help menu, use the -h option.\n\n Additional checks\n\n Ensure that you are using an up-to-date web browser when trying to access the Horizon web interface.\n\n Ensure that Javascript in turned on in your web browser.\n\n Ensure that your user machine can access the server where Horizon was installed.\n\n If several hostnames have been set up for the Horizon interface, ensure that every single one of them is present in the TLS certificate SAN DNS names.\n\n First login\n Introduction", - "keywords": [ - "troubleshooting", - "install-guide", - "install-guide/troubleshooting", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.0", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.0 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.0", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.0.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.0 release notes" - ], - "summary": "Horizon 2.3.0 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.0, released on 2022-09-28. For the installation and upgrade procedure, please refer to the Installation", - "content": "Horizon 2.3.0 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.0, released on 2022-09-28.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HG-419] , [HG-502] - Add Custom Dashboards + default set of charts for CISO/Ops\n\n [HRZ-398] , [HG-502] - Add Stream PKI Connector\n\n [HRZ-397] - Add support for LDAP Publication\n\n 2. Enhancements\n\n [HG-425] - Add list members (Teams)\n\n [HRZ-386] - Add enabled Report\n\n [HRZ-407] - Adding the MSID mapping to the CFCertification request (WCCE)\n\n 3. Bug Fixes\n\n [HRZ-414] - Upgraded dependencies (Scala Framework 2.13.8 → 2.13.9)\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.3.1 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.1", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.1 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.1", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.1.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.1 release notes" - ], - "summary": "Horizon 2.3.1 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.1, released on 2022-10-12. For the installation and upgrade procedure, please refer to the Installation", - "content": "Horizon 2.3.1 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.1, released on 2022-10-12.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HRZ-445] - Disconnect Timeout had no effect with a local account\n\n [HG-532] - Fixed OIDC login issue\n\n [HG-505] - Internal Error after login (Registration Authority)\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.3.2 release notes\n Horizon 2.3.0 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.10", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.10 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.10", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.10.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.10.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.10 release notes" - ], - "summary": "Horizon 2.3.10 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.10, released on 2023-05-11. For the installation and upgrade procedures, please refer to the Installat", - "content": "Horizon 2.3.10 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.10, released on 2023-05-11.\n\n For the installation and upgrade procedures, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1266] - Using the slim JRE image instead of a full JDK\n\n 3. Bug Fixes\n\n [HRZ-1262] - Contact email was discarded on enroll/renew third party scheduled task\n\n [HRZ-1265] - Restoring the Prometheus reporter functionality from Kamon\n\n 4. Known Defects\n\n [None]\n\n Searching requests and certificates\n Horizon 2.3.9 release notes", - "keywords": [ - "horizon", - "10", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.2", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.2 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.2", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.2.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.2.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.2 release notes" - ], - "summary": "Horizon 2.3.2 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.2, released on 2022-11-04. For the installation and upgrade procedures, please refer to the Installatio", - "content": "Horizon 2.3.2 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.2, released on 2022-11-04.\n\n For the installation and upgrade procedures, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-483] - Add \"add bundle\" option and \"pkcs7 format\" to email Triggers\n\n [HRZ-473] - Skip on_submit_enroll notification on direct enrolment\n\n [HRZ-462] - Add dynamic attribute to target a specific request URL\n\n [HRZ-458] - Add horizon-doctor\n\n 3. Bug Fixes\n\n [HRZ-476] - Fixed some defects in dynamic attributes\n\n [HRZ-379] - Password randomly generated not compliant with policy\n\n [HG-604] - Change ORGID value to ORGANIZATIONIDENTIFIER\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.3.3 release notes\n Horizon 2.3.1 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.3", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.3 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.3", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.3.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.3.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.3 release notes" - ], - "summary": "Horizon 2.3.3 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.3, released on 2022-11-07. For the installation and upgrade procedures, please refer to the Installatio", - "content": "Horizon 2.3.3 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.3, released on 2022-11-07.\n\n For the installation and upgrade procedures, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HRZ-504] - Adding the missing dependencies for msal4j\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.3.4 release notes\n Horizon 2.3.2 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.4", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.4 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.4", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.4.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.4.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.4 release notes" - ], - "summary": "Horizon 2.3.4 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.4, released on 2022-11-16. For the installation and upgrade procedures, please refer to the Installatio", - "content": "Horizon 2.3.4 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.4, released on 2022-11-16.\n\n For the installation and upgrade procedures, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-513] - Improving Horizon doctor for 2.3.4\n\n 3. Bug Fixes\n\n [HRZ-507] - \"Request contact email\" does not receive any mail notification\n\n [HRZ-516] - OIDC does not fetch user info data\n\n [HRZ-517] - Horizon-upgrade: fixing database version inference\n\n [HRZ-518] - Renewal broken on AWS and F5 3rd parties\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.3.5 release notes\n Horizon 2.3.3 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.5", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.5 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.5", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.5.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.5.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.5 release notes" - ], - "summary": "Horizon 2.3.5 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.5, released on 2023-01-17. For the installation and upgrade procedures, please refer to the Installatio", - "content": "Horizon 2.3.5 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.5, released on 2023-01-17.\n\n For the installation and upgrade procedures, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-694] - Enhancing OpenID Connect scope filtering\n\n 3. Bug Fixes\n\n [HRZ-691] - Lifecycle operator notifications were sent to registered principals with no role\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.3.6 release notes\n Horizon 2.3.4 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.6", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.6 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.6", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.6.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.6.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.6 release notes" - ], - "summary": "Horizon 2.3.6 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.6, released on 2023-02-07. For the installation and upgrade procedures, please refer to the Installatio", - "content": "Horizon 2.3.6 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.6, released on 2023-02-07.\n\n For the installation and upgrade procedures, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HRZ-743] - Requester and approver comment now properly appears during request search\n\n [HRZ-732] - CertFactory 2.1.10 fixes PKCS#12 encoding for iOS and macOS compatibility\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.3.7 release notes\n Horizon 2.3.5 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.7", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.7 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.7", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.7.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.7.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.7 release notes" - ], - "summary": "Horizon 2.3.7 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.7, released on 2023-02-16. For the installation and upgrade procedures, please refer to the Installatio", - "content": "Horizon 2.3.7 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.7, released on 2023-02-16.\n\n For the installation and upgrade procedures, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-769], [HRZ-773] - Adding the version parameter in the F5 connector\n\n 3. Bug Fixes\n\n [HRZ-759] - Values from pre-validated EST requests were not retrieved before the profile validation\n\n [HRZ-760] - Requesting an EST challenge was possible even for non-requestable profiles\n\n [HRZ-772] - Adding the missing fields from the CSR data mappers\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.3.8 release notes\n Horizon 2.3.6 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.8", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.8 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.8", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.8.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.8.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.8 release notes" - ], - "summary": "Horizon 2.3.8 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.8, released on 2023-03-06. For the installation and upgrade procedures, please refer to the Installatio", - "content": "Horizon 2.3.8 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.8, released on 2023-03-06.\n\n For the installation and upgrade procedures, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-849] - Improving security in the Horizon docker image\n\n 3. Bug Fixes\n\n [None]\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.3.9 release notes\n Horizon 2.3.7 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:release-notes:2.3.9", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Horizon 2.3.9 release notes", - "section": "release-notes", - "slug": "release-notes/2.3.9", - "url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.9.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.3/release-notes/2.3.9.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.3.9 release notes" - ], - "summary": "Horizon 2.3.9 release notes ⚠ Deprecated: This version reached LDOS on 16/05/2025. Here are the release notes for EverTrust Horizon v2.3.9, released on 2023-04-28. For the installation and upgrade procedures, please refer to the Installatio", - "content": "Horizon 2.3.9 release notes\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Here are the release notes for EverTrust Horizon v2.3.9, released on 2023-04-28.\n\n For the installation and upgrade procedures, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1152] - Feeding discovery campaigns with third party data\n\n [HRZ-1198] - Adding trust chain in PKCS#12 file (WebRA centralized enrollment mode)\n\n [HRZ-1175] - Improving SCEP renewal behaviour\n\n 3. Bug Fixes\n\n [HRZ-1196] - Fixing CSR Data Mapper issue with multiple DNS elements (WCCE entity enrollment mode)\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.3.10 release notes\n Horizon 2.3.8 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.3:user-guide:est", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "How to Request an EST challenge", - "section": "user-guide", - "slug": "user-guide/est", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/est.html", - "breadcrumbs": ["Horizon", "User guide", "Requesting an EST challenge"], - "summary": "How to Request an EST challenge ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how you can get an EST Challenge. 1. Log in to Horizon Registration Authority Interface 2. Access My requests from the drawer: 3. Cl", - "content": "How to Request an EST challenge\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how you can get an EST Challenge.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access My requests from the drawer:\n\n 3. Click on add button\n\n 4. Select Request EST Challenge\n\n You must have the permission to request an EST challenge on at least one EST profile.\n\n Profile tab\n\n 1. Select the EST profile.\n\n 2. Click on next button.\n\n Metadata tab\n\n 1. Fill in all the mandatory fields:\n\n Labels(string):\n\nThe labels are used for permission, email and request search.\n\n Contact email address(string email format):\n\nUsed if an email notification is set. An email can be sent each time the request status changes (see request lifecycle ).\n\n Requester comment(string):\n\nThis comment appears:\n\n to the approver when your request is in the pending status\n\n in the certificate information after the enrollment\n\n 2. Click on next button\n\n Summary\n\n If you own the enrolling permission on the EST profile:\n\n 1. Click on the Retrieve challenge button\n\n If you own the \"request\" permission on the EST profile:\n\n 1. Click on request button\n\n You have to wait that your request is approved by an operator and its status is 'completed', in order to use your EST challenge\n\n 2. click on View Request\n\n You now have access to your EST challenge\n\n You can cancel your request at any time, as long as the request status is pending, by clicking on\n\n How to enroll using EST\n\n This section details how to enroll using the Horizon Client ( horizon-cli ). It is also possible to use another EST client implementation, as long as it complies with RFC 7030.\n\n Prerequisites\n\n You need the horizon-cli tools\n\n Enroll with Horizon Client\n\n 1. Set the horizon root endpoint\n\n export ``ENDPOINT``=https://<horizon_url>\n\n The endpoint can instead be set in horizon-cli configuration file\n\n 2. Enroll with horizon-cli\n\n horizon-cli est --enroll <your_challenge> --profile <est_profile> --key <link_to_the_privatekey> --cn <certificate_cn> --cert <name_of_the_output_certificate>\n\n If the enrollment succeeds, the challenge is no longer usable, as it is a one-time password.\n\n Requesting a SCEP challenge\n Managing requests (operator)", - "keywords": [ - "how", - "to", - "request", - "an", - "est", - "challenge", - "user-guide", - "user-guide/est", - "horizon", - "user", - "guide", - "requesting" - ] - }, - { - "page_id": "horizon:2.3:user-guide:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Introduction", - "section": "user-guide", - "slug": "user-guide/introduction", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/introduction.html", - "breadcrumbs": ["Horizon", "User guide", "Introduction"], - "summary": "Introduction ⚠ Deprecated: This version reached LDOS on 16/05/2025. Description Horizon is an EverTrust Certificate lifecycle management solution and is powered up by: Akka BouncyCastle MongoDB Kamon Play! Framework Scala NGINX Vue.js Quasa", - "content": "Introduction\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Description\n\n Horizon is an EverTrust Certificate lifecycle management solution and is powered up by:\n\n Akka\n\n BouncyCastle\n\n MongoDB\n\n Kamon\n\n Play! Framework\n\n Scala\n\n NGINX\n\n Vue.js\n\n Quasar\n\n This document is specific to Horizon version 2.3 .\n\n Syslog Integration\n Managing requests on the WebRA", - "keywords": [ - "introduction", - "user-guide", - "user-guide/introduction", - "horizon", - "user", - "guide" - ] - }, - { - "page_id": "horizon:2.3:user-guide:manage_requests", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Operator", - "section": "user-guide", - "slug": "user-guide/manage_requests", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/manage_requests.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/manage_requests.html", - "breadcrumbs": ["Horizon", "User guide", "Managing requests (operator)"], - "summary": "Operator ⚠ Deprecated: This version reached LDOS on 16/05/2025. An Operator is someone who owns the permission to approve or deny a request. Manage Request This section details how to manage a request (view, approve, deny). 1. Log in to Hor", - "content": "Operator\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n An Operator is someone who owns the permission to approve or deny a request.\n\n Manage Request\n\n This section details how to manage a request (view, approve, deny).\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access Manages requests from the drawer: Manage requests\n\n How to view a request\n\n 3. Click on view request button\n\n 4. Check all the information from the request\n\n 5. At the end you can either approve or deny the request\n\n How to approve a request\n\n 3. Click on approve request button and approve the request\n\n If the certificate has mandatory metadata you will need to fill it in before approving the request, otherwise you will get an error.\n\n How to deny a request\n\n 3. Click on deny request button and deny the request\n\n Requesting an EST challenge\n Searching requests and certificates", - "keywords": [ - "operator", - "user-guide", - "user-guide/manage_requests", - "horizon", - "user", - "guide", - "managing", - "requests" - ] - }, - { - "page_id": "horizon:2.3:user-guide:scep", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "How to Request a SCEP challenge", - "section": "user-guide", - "slug": "user-guide/scep", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/scep.html", - "breadcrumbs": ["Horizon", "User guide", "Requesting a SCEP challenge"], - "summary": "How to Request a SCEP challenge ⚠ Deprecated: This version reached LDOS on 16/05/2025. This section details how you can get a SCEP Challenge. 1. Log in to Horizon Registration Authority Interface 2. Access My requests from the drawer: 3. Cl", - "content": "How to Request a SCEP challenge\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n This section details how you can get a SCEP Challenge.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access My requests from the drawer:\n\n 3. Click on add button\n\n 4. Select Request SCEP Challenge\n\n You must have the permission to request a SCEP challenge on at least one SCEP profile.\n\n Profile tab\n\n 1. Select the SCEP profile\n\n 2. Click on next button\n\n Metadata tab\n\n 1. Fill in all the mandatory fields:\n\n Labels(string):\n\nThe labels are used for permission, email and request search.\n\n Contact email address(string email format):\n\nUsed if an email configuration is set. An email can be sent each time the request status changes (see request lifecycle ).\n\n Requester comment(string):\n\nThis comment appears:\n\n to the approver when your request is in the pending status\n\n in the certificate information after the enrollment\n\n 2. Click on next button\n\n Summary\n\n If you own the enrolling permission on the SCEP profile:\n\n 1. Click on the Retrieve challenge button\n\n If you own the request permission on the SCEP profile:\n\n 1. Click on request button\n\n You have to wait that your request is approved by an operator and its status is 'completed', in order to use your SCEP challenge\n\n 2. click on View Request\n\n You now have access to your SCEP challenge\n\n In order to enroll using SCEP you will need at least a challenge and the SCEP endpoint:\n\n https://<horizon_url>/scep/<profile>/pkiclient.exe\n\n In case you use the NDES emulation, the enrollment and challenge URLs will be respectively:\n- https://<horizon_url>/certsrv/<profile>/mscep\n- https://<horizon_url>/certsrv/<profile>/mscep_admin\n\n You can cancel your request at any time, as long as the request status is pending, by clicking on\n\n How to request a certificate recovery\n Requesting an EST challenge", - "keywords": [ - "how", - "to", - "request", - "scep", - "challenge", - "user-guide", - "user-guide/scep", - "horizon", - "user", - "guide", - "requesting" - ] - }, - { - "page_id": "horizon:2.3:user-guide:search", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Searching requests and certificates", - "section": "user-guide", - "slug": "user-guide/search", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/search.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/search.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Searching requests and certificates" - ], - "summary": "⚠ Deprecated: This version reached LDOS on 16/05/2025. Search Request Here is the section where you can search easily find all information regarding the request. How to do a simple request search 1. Log in to Horizon Registration Authority ", - "content": "⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificate or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificate or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.3.10 release notes", - "keywords": [ - "searching", - "requests", - "and", - "certificates", - "user-guide", - "user-guide/search", - "horizon", - "user", - "guide" - ] - }, - { - "page_id": "horizon:2.3:user-guide:webra:enroll", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "How to enroll a certificate using the WebRA", - "section": "user-guide", - "slug": "user-guide/webra/enroll", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/webra/enroll.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/enroll.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to enroll a certificate using the WebRA" - ], - "summary": "How to enroll a certificate using the WebRA ⚠ Deprecated: This version reached LDOS on 16/05/2025. 1. Log in to Horizon registration authority Interface 2. Access Request Certificate from the drawer: Request Certificate Profile tab 3. Fill ", - "content": "How to enroll a certificate using the WebRA\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n 1. Log in to Horizon registration authority Interface\n\n 2. Access Request Certificate from the drawer: Request Certificate\n\n Profile tab\n\n 3. Fill in all the mandatory fields\n\n Certificate profile * (string select) :\n\nThe certificate profile will be used in order to build the next step of the enrollment.\n\n If the decentralized enrollment is activated for the profile:\n\n Either:\n\n CSR * (string) :\n\nThe CSR in PEM format\n\n Import a CSR file * (file) :\n\nThe CSR file\n\n If the centralized enrollment is activated for the profile:\n\n Key type * (string select) :\n\nThe key type will be used for the private key generation\n\n In case of the definition of a password policy:\n\n Password * (string) :\n\nThe password will be used for the PKCS#12 encryption\n\n You must comply with the configured password policy.\n\n 4. Click on Next button.\n\n Data tab\n\n 5. Fill in all the mandatory fields:\n\n Subject * (string) :\n\nSubject fields will be for the certificate\n\n Subject Alternatives Names * (string) :\n\nSubject Alternative Names will be for the certificate\n\n In decentralized mode, CSR values will be used as default for the corresponding fields.\n\n You must comply with the configured regular expression(s) that you can get with the ? icon.\n\n 6. Click on next button.\n\n Metadata tab\n\n 7. Fill in all the mandatory fields:\n\n Labels * (string) :\n\nThe labels will be used for permission, email and certificate search.\n\n You must comply with the configured regular expression(s) that you can get with the ? icon.\n\n Contact email address (string email format) :\n\nUsed if an email configuration is set. An email can be sent each time the request status changes (see request lifecycle ).\n\n Requester comment (string) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n 8. Click on next button.\n\n Summary tab\n\n If you own the enrolling permission\n\n 9. Click on enroll button\n\nYou can download the PKCS#12 after the enrollment if you are allowed to in the profile\n\n If you own the request certificate permission\n\n 9. Click on request button\n\nYou have to wait until your request is approved, afterward you will be able to download the PKCS#12 if you are allowed to in the profile\n\n Managing requests on the WebRA\n How to request a certificate revocation", - "keywords": [ - "how", - "to", - "enroll", - "certificate", - "using", - "the", - "webra", - "user-guide", - "user-guide/webra/enroll", - "horizon", - "user", - "guide", - "managing", - "requests", - "on" - ] - }, - { - "page_id": "horizon:2.3:user-guide:webra:recover", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "How to request a certificate recovery", - "section": "user-guide", - "slug": "user-guide/webra/recover", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/webra/recover.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/recover.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate recovery" - ], - "summary": "How to request a certificate recovery ⚠ Deprecated: This version reached LDOS on 16/05/2025. 1. Log in to Horizon Registration Authority Interface 2. Access request recover from the drawer: My certificate or Search certificates 3. Click on ", - "content": "How to request a certificate recovery\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request recover from the drawer: My certificate or Search certificates\n\n 3. Click on request recover button\n\n Recover Options tab\n\n 4. Fill in the information you want to add.\n\n Contact_Email (string email format) :\n\nUsed if an email configuration is set. An email can be sent every time the request status change (see request lifecycle ).\n\n Recover comment (string regex) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n Certificate tab\n\n 5. You can also check the certificate information\n\n Details tab\n\n 6. You can also check the certificate information\n\n 7. Once you have checked and added the information you wanted you can request the recover by clicking on the recover button\n\n 8. You will be able to see and copy the password and download the certificate PKCS#12\n\n How to request a certificate renewal\n Requesting a SCEP challenge", - "keywords": [ - "how", - "to", - "request", - "certificate", - "recovery", - "user-guide", - "user-guide/webra/recover", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.3:user-guide:webra:renew", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "How to request a certificate renewal", - "section": "user-guide", - "slug": "user-guide/webra/renew", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/webra/renew.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/renew.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate renewal" - ], - "summary": "How to request a certificate renewal ⚠ Deprecated: This version reached LDOS on 16/05/2025. 1. Log in to Horizon Registration Authority Interface 2. Access request renew from the drawer: My certificate or Search certificates 3. Click on req", - "content": "How to request a certificate renewal\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request renew from the drawer: My certificate or Search certificates\n\n 3. Click on request renew button\n\n Profile tab\n\n 4. Fill in all the mandatory fields\n\n Key type * (string) :\n\nThe key type will be used for the private key generation\n\n In case of the definition of a password policy:\n\n Password * (string) :\n\nThe password will be used for the PKCS#12 encryption\n\n 5. Go to enroll (same as renew) and follow all the steps\n\n How to request a certificate update\n How to request a certificate recovery", - "keywords": [ - "how", - "to", - "request", - "certificate", - "renewal", - "user-guide", - "user-guide/webra/renew", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.3:user-guide:webra:revoke", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "How to request a certificate revocation", - "section": "user-guide", - "slug": "user-guide/webra/revoke", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/webra/revoke.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/revoke.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate revocation" - ], - "summary": "How to request a certificate revocation ⚠ Deprecated: This version reached LDOS on 16/05/2025. 1. Log in to Horizon registration authority Interface 2. Access Either my certificates or Search certificates from the drawer: My Certificates / ", - "content": "How to request a certificate revocation\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n 1. Log in to Horizon registration authority Interface\n\n 2. Access Either my certificates or Search certificates from the drawer: My Certificates / Search Certificates\n\n 3. Click on the Revoke icon:\n\n The revoke icon appears only if you own the permission to revoke the certificate\n\n Revocation Options tab\n\n 4. Fill in all the mandatory fields.\n\n Revocation reason * (String select) :\n\nThe revocation reason that will appear on the CRL\n\n Contact email address (string email format) :\n\nUsed if an email configuration is set. An email can be sent each time the request status changes (see request lifecycle )\n\n Requester comment (String) :\n\nThis comment appears:\n\n by the approver when your request is in the pending status\n\n to the certificate info after the revocation\n\n 5. Click on Certificate tab\n\n Certificate tab\n\n 6. Check the certificate’s information\n\n 7. Click on Details tab\n\n Details tab\n\n 8. Check the certificate’s details\n\n If you have the enrolling permission\n\n 9. Click on the enroll button\n\nYou can download the PKCS#12 after the enrollment if you are allowed to in the profile\n\n If you own the request certificate permission\n\n 9. Click on request button\n\nYou have to wait until your request is approved, afterward you will be able to download the PKCS#12 if you are allowed to in the profile\n\n How to enroll a certificate using the WebRA\n How to request a certificate update", - "keywords": [ - "how", - "to", - "request", - "certificate", - "revocation", - "user-guide", - "user-guide/webra/revoke", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.3:user-guide:webra:update", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "How to request a certificate update", - "section": "user-guide", - "slug": "user-guide/webra/update", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/webra/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/update.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate update" - ], - "summary": "How to request a certificate update ⚠ Deprecated: This version reached LDOS on 16/05/2025. 1. Log in to Horizon Registration Authority Interface 2. Access request update from the drawer: My certificate or Search certificates 3. Click on req", - "content": "How to request a certificate update\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request update from the drawer: My certificate or Search certificates\n\n 3. Click on request update button\n\n Details tab\n\n 4. You can update in the metadata section the fields contact_email and labels (if labels are mandatory)\n\n Label (string regex) :\n\nEnter a correct label\n\n Contact_Email (string email format) :\n\nUsed if an email configuration is set. An email can be sent each time the request status change (see request lifecycle ).\n\n 5. You can also check the details information\n\n Certificate tab\n\n 6. You can also check the certificate information\n\n 7. Once you have made changes you can request the update by clicking on the update button\n\n How to request a certificate revocation\n How to request a certificate renewal", - "keywords": [ - "how", - "to", - "request", - "certificate", - "update", - "user-guide", - "user-guide/webra/update", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.3:user-guide:webra:workflow", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.3", - "title": "Requester", - "section": "user-guide", - "slug": "user-guide/webra/workflow", - "url": "https://docs.evertrust.fr/horizon/2.3/user-guide/webra/workflow.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/workflow.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA" - ], - "summary": "Requester ⚠ Deprecated: This version reached LDOS on 16/05/2025. By definition, a requester is someone who is granted the permission to request a certificate (enroll, renew, revoke, update, recover). Each Request has the same lifecycle desc", - "content": "Requester\n\n ⚠  Deprecated: This version reached LDOS on 16/05/2025.\n\n By definition, a requester is someone who is granted the permission to request a certificate (enroll, renew, revoke, update, recover).\n\n Each Request has the same lifecycle described by the following figure.\n\n Figure 1. Request Workflow\n\n Introduction\n How to enroll a certificate using the WebRA", - "keywords": [ - "requester", - "user-guide", - "user-guide/webra/workflow", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:automation:automation_policies", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Automation Policy", - "section": "admin-guide", - "slug": "admin-guide/automation/automation_policies", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/automation/automation_policies.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/automation/automation_policies.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Automation", - "Automation Policy" - ], - "summary": "Automation Policy Automation policies allow you to choose when and how to automate your certificate renewal, while also providing additional security policy parameters. Configure your automation policies 1. Log in to Horizon Administration ", - "content": "Automation Policy\n\n Automation policies allow you to choose when and how to automate your certificate renewal, while also providing additional security policy parameters.\n\n Configure your automation policies\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Automation policy from the drawer or card: Automation   Automation Policy .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful policy name. It must be unique for each automation policy. Horizon use the name to identify the policy.\n\n Profile * (select) :\n\nSelect an existing SCEP, EST or ACME profile on which to enroll the certificates.\n\nCryptographic information, such as the key types for certificate enrollment are taken from the profile Crypto Policy.\n\n Execution policy (select) :\n\nSelect a preexisting execution policy. If no policy is selected, renewal actions are always allowed.\n\n Compliance\n\n Authorized CAs (multiselect) :\n\nSelect CAs on which the certificate will be considered as compliant if its issuer is in the list. An empty list means all issuing CAs are authorized.\n\n Authorized hash algorithms (multiselect) :\n\nSelect algorithms on which the certificate will be considered as compliant if its hash algorithm is in the list. An empty list means all hash algorithms are authorized.\n\n Trust chains (multiselect) :\n\nSelect trust chains that will be installed on the machine at the same time as the certificate installation. If no chain is specified, only the one optionally needed by the server will be installed.\n\n 5. Click on the save button.\n\n You can edit or delete the policy.\n\n Execution Policy\n ACME Introduction", - "keywords": [ - "automation", - "policy", - "admin-guide", - "admin-guide/automation/automation_policies", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:automation:execution_policies", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Execution Policy", - "section": "admin-guide", - "slug": "admin-guide/automation/execution_policies", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/automation/execution_policies.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/automation/execution_policies.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Automation", - "Execution Policy" - ], - "summary": "Execution Policy Execution policies are a way to define time periods during which execution of automated actions are permitted. This allows you to avoid a service interruption during business hours. Configure your execution policies 1. Log ", - "content": "Execution Policy\n\n Execution policies are a way to define time periods during which execution of automated actions are permitted. This allows you to avoid a service interruption during business hours.\n\n Configure your execution policies\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Execution policy from the drawer or card: Automation   Execution Policy .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful policy name. It must be unique for each execution policy. Horizon use the name to identify the policy.\n\n Description (string input) :\n\nEnter a description for your policy. It will be displayed in a tooltip on the policy list view.\n\n Authorized periods\n\n The Horizon Client can perform automation operations in the following time frames.\n\n Click on .\n\n Start Date (date: yyyy-mm-dd) :\n\nEnter the start date of this period. If no start and no end date are defined, all dates are in this period.\n\n End Date (date: yyyy-mm-dd) :\n\nEnter the end date of this period. If no start and no end date are defined, all dates are in this period.\n\n Start Time (time: hh:mm:ss) :\n\nEnter the start time of this period. If no start and no end time are defined, all times are in this period.\n\n End Time (time: hh:mm:ss) :\n\nEnter the end time of this period. If no start and no end time are defined, all times are in this period.\n\n Day selector :\n\nEnter the authorized days of the week.\n\nSelecting no weekdays means no weekdays are in this period.\n\n You can delete periods.\n\n Forbidden periods\n\n The Horizon Client cannot perform automation operations in the following time frames.\n\n Click on .\n\n Start Date (date: yyyy-mm-dd) :\n\nEnter the start date of this period. If no start and no end date are defined, all dates are in this period.\n\n End Date (date: yyyy-mm-dd) :\n\nEnter the end date of this period. If no start and no end date are defined, all dates are in this period.\n\n Start Time (time: hh:mm:ss) :\n\nEnter the start time of this period. If no start and no end time are defined, all times are in this period.\n\n End Time (time: hh:mm:ss) :\n\nEnter the end time of this period. If no start and no end time are defined, all times are in this period.\n\n Day selector :\n\nEnter the authorized days of the week.\n\nSelecting no weekdays means no weekdays are in this period.\n\n You can delete periods.\n\n 5. Click on the save button.\n\n You can edit or delete the policy.\n\n Automation Introduction\n Automation Policy", - "keywords": [ - "execution", - "policy", - "admin-guide", - "admin-guide/automation/execution_policies", - "horizon", - "admin", - "guide", - "automation" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:automation:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Automation Introduction", - "section": "admin-guide", - "slug": "admin-guide/automation/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/automation/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/automation/introduction.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Automation", - "Automation Introduction" - ], - "summary": "Automation Introduction Certificate Lifecycle Automation allows your certificates to always be up to date with your security policy without interrupting your services unexpectedly, and without need of tiring manual operations. The following", - "content": "Automation Introduction\n\n Certificate Lifecycle Automation allows your certificates to always be up to date with your security policy without interrupting your services unexpectedly, and without need of tiring manual operations.\n\n The following elements are needed to allow this behavior to take place:\n\n horizon-cli : The horizon client. Installed on your server machine, it will communicate with Horizon to know when to perform the certificate change, and it will install the new certificate automatically. This feature is only available since client version 1.6.0 .\n\n On EverTrust Horizon side:\n\n Execution policies : Define when the interruption of service to switch the certificate should take place.\n\n Automation policies : Define what profile to enroll the certificates on, and also various cryptographic parameters.\n\n Profiles : Define on which protocol and PKI your certificate is enrolled, and its contents. Automation is available on SCEP , ACME and EST profiles.\n\n Discovery\n Execution Policy", - "keywords": [ - "automation", - "introduction", - "admin-guide", - "admin-guide/automation/introduction", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:ca", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Certification Authorities", - "section": "admin-guide", - "slug": "admin-guide/ca", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/ca.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/ca.html", - "breadcrumbs": ["Horizon", "Admin guide", "Certification Authorities"], - "summary": "Certification Authorities This section details how to configure the Certification Authorities known by EverTrust Horizon. Prerequisites Certification Authorities will be needed beforehand, in one of these formats: Certificate file (PEM or D", - "content": "Certification Authorities\n\n This section details how to configure the Certification Authorities known by EverTrust Horizon.\n\n Prerequisites\n\n Certification Authorities will be needed beforehand, in one of these formats:\n\n Certificate file (PEM or DER).\n\n Certificate string (PEM).\n\n You might also need the URL of the CRL issued by the CA, and/or the URL of the OCSP Responder for that CA.\n\n How to configure a Certification Authority\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Certification Authorities from the drawer or card: Certification Authorities .\n\n 3. Click on .\n\n Certificate Tab:\n\n 4. Either\n\n Fill in the certificate section with certificate string (PEM) OR\n\n Import the certificate file (PEM or DER).\n\n Then click on the next button.\n\n Details Tab:\n\n 5. Check the information from your CA certificate. Then click on the next button.\n\n Configuration Tab:\n\n 6. Fill in the information you want to add.\n\n Name * (string input) :\n\nEnter a meaningful certificate authority name. It must be unique for each certificate authority.\n\n OCSP responder URL (string) :\n\nURL to request an OCSP responder.\n\n CRL URL (string) :\n\nURL to download the CA CRL.\n\n Refresh Period ( finite duration ) :\n\nCRL or OCSP Refresh Period. Must be a valid finite duration.\n\n Timeout ( finite duration ) :\n\nConnection timeout when reaching CRL or OCSP. Must be a valid finite duration.\n\n Proxy (string select) :\n\nThe HTTP/HTTPS proxy to use to reach the CRL or the OCSP Responder, if any.\n\n Is exposed on Registration Authority (boolean) :\n\nDisplay the CA in the Trust chains view on the RA side. The default value is set to false.\n\n Is trusted for server authentication (boolean) :\n\nTells whether the CA should be trusted for server authentication, aka SSL/TLS server trust. The default value is set to false.\n\n Is trusted for client authentication (boolean) :\n\nTells whether the CA should be trusted for client authentication. The default value is set to false.\n\n Outdated Revocation Status Policy (option) :\n\nSelect \"Revoked\" if you want all certificates to be handled as revoked if the CRL/OCSP are unavailable. Select \"Last available status\" if you want Horizon to use the last available revocation status for the certificates.\n\n 7. Click on the import button.\n\n You can edit , download or delete the Certification Authorities.\n\n You will not be able to delete a Certification Authority if it is referenced in any other configuration element.\nPay also attention that the CA might be used (e.g. for TLS trust chain building), even if it is not explicitly referenced in configuration items.\n\n User Information\n PKI Queue", - "keywords": [ - "certification", - "authorities", - "admin-guide", - "admin-guide/ca", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:aws", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "AWS PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/aws", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/aws.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/aws.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "AWS" - ], - "summary": "AWS PKI Prerequisites You need to create a user using AWS IAM, and give it the AWSCertificateManagerPrivateCAUser right. You need to retrieve the Private CA ARN from ACM Private CA console. Refer to the editor’s documentation to configure t", - "content": "AWS PKI\n\n Prerequisites\n\n You need to create a user using AWS IAM, and give it the AWSCertificateManagerPrivateCAUser right.\n\n You need to retrieve the Private CA ARN from ACM Private CA console.\n\n Refer to the editor’s documentation to configure the PKI side here .\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n AWS Region * (string input) :\n\nAWS region to use.\n\n AWS PCA ARN * (string input) :\n\nAmazon Resource Name (ARN) is a file naming convention used to identify a particular resource in AWS public cloud. To be retrieved from AWS ACM Console.\n\n AWS PCA Template ARN (string input) :\n\nA template is a declaration of the AWS resources that make up a stack. The default value is set to: arn:aws:acm-pca:::template/EndEntityCertificate/V1 .\n\n AWS PCA Role ARN (string input)\n\n Certificate Policy OID (string input) :\n\nAn identifying number, in the form of an \"object identifier\" that is included in the certificatePolicies field of a certificate.\n\n Certificate signing hash (select) :\n\nSelect the hash function that will be used.\n\n Certificate Usage (select) :\n\nSelect the certificate usage.\n\n Number of valid days ( finite duration ) :\n\nCertificate validity duration in days. Must be a valid finite duration.\nThe default value is set to 365 days.\n\n Retry Interval ( finite duration ) :\n\nPredefined interval of time before retrying to retrieve the certificate from AWS. Must be a valid finite duration.\nThe default value is set to 3 seconds.\n\n 9. Click on the next button\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n AWS user access key ID (string input) :\n\nFind AWS Account and Access Keys.\n\n AWS user secret key (string input) :\n\nMust be set only if and only if AWS user access key ID is set.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the AWS PKI connector.\n\n General Information\n CertEurope", - "keywords": [ - "aws", - "pki", - "admin-guide", - "admin-guide/connectors/aws", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:certeurope", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "CertEurope PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/certeurope", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/certeurope.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/certeurope.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "CertEurope" - ], - "summary": "CertEurope PKI Prerequisites A technical account should be created. This technical account must have permissions to enroll and revoke SSL certificates on the desired domain(s). Limitations Only the following fields are managed: commonName a", - "content": "CertEurope PKI\n\n Prerequisites\n\n A technical account should be created.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired domain(s).\n\n Limitations\n\n Only the following fields are managed: commonName and subjectAltName DNS .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in CCS for the given \"Offer Identifier\", the exceeding items will be ignored.\n\n All limitations induced by the use of the CCS REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Endpoint URL to the CSS partner API * (string input) :\n\nURL to access the CertEurope web service API.\n\n Technical account login * (string input) :\n\nLogin of the technical account created in CCS, usually an email address.\n\n Technical account password * (string input) :\n\nPassword of the technical account created in CCS.\n\n CCS offer identifier * (string input) :\n\nThe identifier of the offer within CCS.\n\n Organization ID * (string input) :\n\nCustomer organization ID. For French companies, it’s usually the \"SIREN\".\n\n Revocation reason (string select) :\n\nSelect from the drop down the default revocation reason.\n\n Interval before retrying to retrieve certificate ( finite duration ) :\n\nThe default value is set to 21 seconds.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import) :\n\nPKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the CertEurope PKI connector.\n\n AWS\n CS-Novidy’s TrustKey", - "keywords": [ - "certeurope", - "pki", - "admin-guide", - "admin-guide/connectors/certeurope", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:csnovidy", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "CS-Novidy’s TrustyKey PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/csnovidy", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/csnovidy.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/csnovidy.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "CS-Novidy’s TrustKey" - ], - "summary": "CS-Novidy’s TrustyKey PKI Prerequisites A technical account should be created. This technical account must have permissions to enroll and revoke SSL certificates on the desired certificate profiles. An authentication and a signature certifi", - "content": "CS-Novidy’s TrustyKey PKI\n\n Prerequisites\n\n A technical account should be created.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired certificate profiles.\n\n An authentication and a signature certificate must be issued under as PKCS#12 files for this account.\n\n Limitations\n\n Only the following fields are managed: commonName (as mail_lastname), contactEmail (as mail_email), OU (as org_unit), O (as corp_company), C (as country), UID (as employeeID), subjectAltNames DNS and msUPN .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in TrustyKey for the given PGC , the exceeding items will be ignored.\n\n All limitations induced by the use of the TrustyKey CMP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n API endpoint URL * (string input) :\n\nURL to access the CS-Novidy’s TrustyKey web service.\n\n PGC * (string input) :\n\nEnter name of the PGC to be used.\n\n TrustyKey PKI server DN * (string input) :\n\nEnter the DN of the TrustyKey PKI server, starting from the CN.\n\n TrustyKey PKI server Certificate * (string input) :\n\nEnter the PEM representing the certificate of the CA issuing the certificates.\n\n CN mapping (string input) :\n\nEnter a CN to be mapped.\n\n Email mapping (string input) :\nEnter an email address or domain to be mapped.\n\n SAN DNS mapping (string input) :\n\nEnter a SAN DNS to be mapped.\n\n Profile mapping (string input) :\n\nEnter a profile to be mapped.\n\n Issuer mapping (string input) :\n\nEnter an issuer to be mapped.\n\n Legacy CMP Style (boolean)\n\nChose whether to use the legacy CMP style.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n Signer PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the signature certificate used to sign the CMP messages.\n\n Signer certificate password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the CS-Novidy’s TrustyKey PKI connector.\n\n CertEurope\n Digicert CertCentral", - "keywords": [ - "cs-novidy", - "trustykey", - "pki", - "admin-guide", - "admin-guide/connectors/csnovidy", - "horizon", - "admin", - "guide", - "pkis", - "connectors", - "trustkey" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:digicert", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "DigiCert CertCentral PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/digicert", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/digicert.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/digicert.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Digicert CertCentral" - ], - "summary": "DigiCert CertCentral PKI Prerequisites You need to validate the domain(s) for which you will issue certificates prior to their issuance. This can be done in DigiCert CertCentral in the Certificates > Domains menu. You need to retrieve th", - "content": "DigiCert CertCentral PKI\n\n Prerequisites\n\n You need to validate the domain(s) for which you will issue certificates prior to their issuance. This can be done in DigiCert CertCentral in the Certificates > Domains menu.\n\n You need to retrieve the organizationId from DigiCert CertCentral in the Certificates > Organizations menu.\n\n You need to generate an API Key in DigiCert CertCentral using the Account > Account Access menu.\n\n Limitations\n\n Only the following fields are managed: commonName and subjectAltName DNS and RFC822Name .\n\n For multi-valued fields (SAN DNS and RFC822Name ), if more data items are provided than configured in DigiCert CertCentral for the given type of certificate, the exceeding items will be ignored.\n\n All limitations induced by the use of the DigiCert CertCentral REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n DigiCert CertCentral API endpoint * (string input or select) :\n\nURL to access DigiCert CertCentral API along with the certificate type to issue. To do so you can select from the drop down menu or type in your \"certificate offer\" value, then press \"Enter\" the corresponding URL will be automatically fetched.\n\n DigiCert CertCentral Customer Organization ID * (int) :\n\nEnter customer organization ID.\n\n DigiCert CertCentral CA Cert ID (int) :\n\nEnter CA Cert ID, to be used for private CA only.\n\n Interval before retrying to retrieve certificate ( finite duration ) :\n\nUse for private CA only.\nThe default value is set to 9 seconds.\n\n Skip Approval (boolean) :\n\nThe default value is set to false.\n\n 9. Click on the next button.\n\n Custom tab\n\n 10. Click on if custom data mapping is needed.\n\n 11. Fill in the PKI-custom data mapping:\n\n Custom data field * (string input) :\n\n Label field * (select) :\n\nAny existing Horizon Label\n\n 12. Click on the next button.\n\n Authentication tab\n\n 13. Fill in the PKI-authentication fields:\n\n DigiCert CertCentral API Key * (string input) :\n\nEnter the API Key.\n\n 14. Click on the save button.\n\n You can edit , duplicate or delete the DigiCert CertCentral PKI connector.\n\n CS-Novidy’s TrustKey\n EJBCA", - "keywords": [ - "digicert", - "certcentral", - "pki", - "admin-guide", - "admin-guide/connectors/digicert", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:ejbca", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "EJBCA PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/ejbca", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/ejbca.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/ejbca.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "EJBCA" - ], - "summary": "EJBCA PKI Prerequisites A certificate profile should be created, e.g. reusing the default \"SERVER\" certificate profile. An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation p", - "content": "EJBCA PKI\n\n Prerequisites\n\n A certificate profile should be created, e.g. reusing the default \"SERVER\" certificate profile.\n\n An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned certificate procedure.\n\n Limitations\n\n Only the following fields are managed: all Subject DN fields and subjectAltNames DNS, IPaddress, RFC822Name, msUPN and msGUID .\n\n For multi-valued fields (SAN DNS and RFC822Name ), if more data items are provided than configured in EJBCA for the given End Entity profile, the exceeding items will be ignored.\n\n All limitations induced by the use of the EJBCA RA SOAP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n EJBCA RA URL * (string input) :\n\nEnter SOAP endpoint URL of the EJBCA WebService.\n\n EJBCA Certificate Profile Name * (string input) :\n\nEnter EJBCA Certificate Profile to map for certificate issuance.\n\n EJBCA CA Name * (string input) :\n\nEnter CA to use for certificate issuance.\n\n EJBCA End Entity Profile * (string input) :\n\nEnter EJBCA End Entity profile.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the EJBCA PKI connector.\n\n Digicert CertCentral\n Entrust Certificates Services", - "keywords": [ - "ejbca", - "pki", - "admin-guide", - "admin-guide/connectors/ejbca", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:entrust", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Entrust Certificate Services PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/entrust", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/entrust.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/entrust.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Entrust Certificates Services" - ], - "summary": "Entrust Certificate Services PKI Prerequisites A technical account should be created to be used with the API. This technical account must have permissions to enroll and revoke SSL certificates on the desired certificate profiles (superadmin", - "content": "Entrust Certificate Services PKI\n\n Prerequisites\n\n A technical account should be created to be used with the API.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired certificate profiles (superadmin role).\n\n Limitations\n\n Only the following fields are managed: commonName (as cn, for SMIME certs), contactEmail (as requester email address), OU (only one) and subjectAltName DNS (for SSL certs) and RFC822Name (for SMIME) .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in ECS for the given certificate type, the exceeding items will be ignored.\n\n All limitations induced by the use of the ECS REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Technical account API login * (string input) :\n\nEnter the login of the technical account API.\n\n Technical account API password * (string input) :\n\nEnter the password of the technical account API.\n\n Certificate Type (select) :\n\nSelect the Certificate Type to issue.\n\n Requester’s default email * (string input) :\n\nEnter the requester default email address.\n\n Requester’s name (string input) :\n\nEnter the requester name to register.\n\n Requester’s phone (string input) :\n\nEnter the requester phone to register.\n\n Certificate lifetime ( finite duration ) :\nEnter Certificate lifetime, in days. For SMIME_ENT it is the number of years.\nThe default value is set to 90 days.\n\n Client ID (int) :\n\nEnter Client ID.\nThe default value is set to 1.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Entrust Certificate Services PKI connector.\n\n EJBCA\n EverTrust Integrated CA", - "keywords": [ - "entrust", - "certificate", - "services", - "pki", - "admin-guide", - "admin-guide/connectors/entrust", - "horizon", - "admin", - "guide", - "pkis", - "connectors", - "certificates" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:fisid", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "FISId PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/fisid", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/fisid.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/fisid.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "FISId" - ], - "summary": "FISId PKI Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI PKI Connectors . 3. Click on . 4. Select the correct PKI type. 5. Click on the next button General tab 6. Fill in t", - "content": "FISId PKI\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n FISId endpoint URL * (string input) :\n\nURL to access the API.\n\n Template ID * (int) :\n\nEnter the template ID.\n\n Default owner ID * (string input) :\n\nEnter a default owner ID.\n\n Authentication domain ID * (int) :\n\nEnter an authentication domain ID.\n\n Owner groups (string input) :\n\nEnter one or several, separated by commas\n\n To delete after revocation (boolean) :\n\nThe default value is set to false.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n API Key * (string input) :\n\nEnter app key.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the FISId PKI connector.\n\n EverTrust Stream CA\n GlobalSign Atlas", - "keywords": [ - "fisid", - "pki", - "admin-guide", - "admin-guide/connectors/fisid", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:globalsign_atlas", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "GlobalSign Atlas PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/globalsign_atlas", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/globalsign_atlas.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/globalsign_atlas.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "GlobalSign Atlas" - ], - "summary": "GlobalSign Atlas PKI Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI PKI Connectors . 3. Click on . 4. Select the correct PKI type. 5. Click on the next button General tab 6", - "content": "GlobalSign Atlas PKI\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Hash Algorithm (select) :\n\nSelect the hash algorithm for the certificate to be issue.\n\n API Key * (string input) :\n\nEnter the key that allows to authenticate against GlobalSign Atlas API.\n\n API Secret * (string input) :\n\nEnter the password used to secure the aforementioned API Key.\n\n Certificate Usage (select) :\n\nSelect a usage from the drop down list.\n\n Retry Interval ( finite duration ) :\n\nThe default value is set to 3 seconds.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 10. Click on the save button.\n\n You can edit , duplicate or delete the GlobalSign Atlas PKI connector.\n\n FISId\n GlobalSign MSSL", - "keywords": [ - "globalsign", - "atlas", - "pki", - "admin-guide", - "admin-guide/connectors/globalsign_atlas", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:globalsign_mssl", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "GlobalSign MSSL PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/globalsign_mssl", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/globalsign_mssl.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/globalsign_mssl.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "GlobalSign MSSL" - ], - "summary": "GlobalSign MSSL PKI Prerequisites A technical account should be created. This technical account must have permissions to enroll and revoke SSL certificates on the desired domain. Limitations Only the following fields are managed: contactEma", - "content": "GlobalSign MSSL PKI\n\n Prerequisites\n\n A technical account should be created.\n\n This technical account must have permissions to enroll and revoke SSL certificates on the desired domain.\n\n Limitations\n\n Only the following fields are managed: contactEmail and subjectAltName DNS .\n\n For multi-valued fields (SAN DNS), if more data items are provided than configured in GlobalSign MSSL for the given \"Product\", the exceeding items will be ignored.\n\n All limitations induced by the use of the GlobalSign MSSL SOAP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n GlobalSign endpoint * (string select) :\n\nSelect from the drop-down list: the value must be \"prod\" for GlobalSign Production endpoint or \"test\" for the test environment.\n\n GlobalSign profile ID * (string input) :\n\nTo be retrieved from the URL in the GlobalSign MSSL console.\n\n GlobalSign domain ID * (string input) :\n\nThe ID of the domain to manage. Displayed in the GlobalSign MSSL console.\n\n Certificate validity (int input) :\n\nCertificate validity in months.\n\n Default email address (string input) :\n\nChoose a default email address.\n\n Default phone number (string input) :\n\nChoose a default phone number.\n\n Interval before retrying to retrieve certificate ( finite duration ) :\n\nThe default value is set to 9 seconds.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Technical account username * (string input) :\n\nUsername of the technical account created in GlobalSign MSSL.\n\n Technical account password * (string input) :\n\nPassword of the technical account created in GlobalSign MSSL.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the GlobalSign MSSL PKI connector.\n\n GlobalSign Atlas\n MetaPKI", - "keywords": [ - "globalsign", - "mssl", - "pki", - "admin-guide", - "admin-guide/connectors/globalsign_mssl", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:integrated", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "EverTrust integrated CA", - "section": "admin-guide", - "slug": "admin-guide/connectors/integrated", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/integrated.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/integrated.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "EverTrust Integrated CA" - ], - "summary": "EverTrust integrated CA Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI PKI Connectors . 3. Click on . 4. Select the correct PKI type. 5. Click on the next button General ta", - "content": "EverTrust integrated CA\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Certificate Type * (select) :\n\nSpecify the certificate type to issue.\n\n Signing algorithm * (select) :\n\nSpecify the signing algorithm.\n\n CA Certificate (string input) :\n\nEnter CA certificate.\n\n CA Key (string input) :\n\nEnter CA key.\n\n CRL save path (string input) :\n\nPath to save the CRL on the Horizon server.\n\n CRL lifetime ( finite duration ) :\n\nCRL lifetime in days. Must be a valid finite duration.\n\n Certificate Back Date ( finite duration ) :\n\nCertificate Back Date. Must be a valid duration.\n\n Check Proof of Possession (boolean)\n\n 9. Click on the save button.\n\n You can edit , duplicate or delete the EverTrust integrated CA PKI connector.\n\n Entrust Certificates Services\n EverTrust Stream CA", - "keywords": [ - "evertrust", - "integrated", - "ca", - "admin-guide", - "admin-guide/connectors/integrated", - "horizon", - "admin", - "guide", - "pkis", - "pki", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:metapki", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "MetaPKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/metapki", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/metapki.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/metapki.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "MetaPKI" - ], - "summary": "MetaPKI Prerequisites Endpoint issuing CA Create the PKI connector 1. Log in to Horizon Administration Interface. 2. Access PKI from the drawer or card: PKI PKI Connectors . 3. Click on . 4. Select the correct PKI type. 5. Click on the next", - "content": "MetaPKI\n\n Prerequisites\n\n Endpoint issuing CA\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Endpoint * (string input) :\n\nThe MetaPKI Endpoint.\n\n Endpoint Issuing CA * (string select) :\n\nSelect the CA that will be issuing the certificates for this connector (from the imported Horizon CAs)\n\n Profile * (string input) :\n\nExample: Applications_Auth_Client_Serveur_SSL.\n\n Profile Cle * (string input) :\n\nExample: Serveur_SSL\n\n Workflow * (string input) :\n\nExample: S_LOCAL_SOFT\n\n Form Porteur Name (string input)\n\n Valid Days ( finite duration )\n\nCertificate lifetime in days (must be a valid finite duration).\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the MetaPKI PKI connector.\n\n GlobalSign MSSL\n MSAD Certificate Services", - "keywords": [ - "metapki", - "admin-guide", - "admin-guide/connectors/metapki", - "horizon", - "admin", - "guide", - "pkis", - "pki", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:msadcs", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Microsoft Active Directory Certificate Services PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/msadcs", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/msadcs.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/msadcs.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "MSAD Certificate Services" - ], - "summary": "Microsoft Active Directory Certificate Services PKI Setup of the ADCS Connector ADCS Connector installation guide must be completed prior to the configuration of this connector. Creating the ADCS PKI Connector in Horizon Limitations All lim", - "content": "Microsoft Active Directory Certificate Services PKI\n\n Setup of the ADCS Connector\n\n ADCS Connector installation guide must be completed prior to the configuration of this connector.\n\n Creating the ADCS PKI Connector in Horizon\n\n Limitations\n\n All limitations induced by the use of ADCS.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Endpoint * (string input) :\n\nURL to access the machine where the ADCS connector is running on port 4443.\n\n Active Directory Domain Netbios Name * (string input) :\n\nThe NETBIOS name of the Active Directory domain where to find the technical user and the ADCS server.\n\n Profile * (string input) :\n\nThe technical name of the template that you created in Setup of the ADCS Connector section. Example: WebServer\n\n CA Config * (string input) :\n\nThe CaConfig string, as given out by certutil -config for the considered ADCS CA. It’s usually in the form <ADCS Hostname>\\<CA CommonName>\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the ADCS authentication fields:\n\n Enrollment agent certificate * (import) :\n\nImport the PKCS#12 enrollment agent certificate that was exported at step 10 of the Setup of the ADCS Connector section.\n\n PKCS#12 password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n MS ADCS user account name * (string input) :\n\nFill in the username of the technical account created at step 9 of the Setup of the ADCS Connector section.\n\n MS ADCS user account password * (string input) :\n\nPassword associated with aforementioned defined user.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Microsoft Active Directory Certificate Services PKI connector.\n\n MetaPKI\n Nexus Certificate Manager", - "keywords": [ - "microsoft", - "active", - "directory", - "certificate", - "services", - "pki", - "admin-guide", - "admin-guide/connectors/msadcs", - "horizon", - "admin", - "guide", - "pkis", - "connectors", - "msad" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:nexus", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Nexus Certificate Manager PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/nexus", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/nexus.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/nexus.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Nexus Certificate Manager" - ], - "summary": "Nexus Certificate Manager PKI Prerequisites A certificate procedure and a token procedure should be created. An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions ", - "content": "Nexus Certificate Manager PKI\n\n Prerequisites\n\n A certificate procedure and a token procedure should be created.\n\n An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned token procedure.\n\n Nexus Endpoint CA\n\n Limitations\n\n Only the following fields are managed: commonName, UID, OU, O, C and subjectAltNames DNS, IPaddress, RFC822Name and msUPN .\n\n For multi-valued fields (SAN DNS, RFC822Name and IP address), if more data items are provided than configured in Nexus CM Procedure, the exceeding items will be ignored.\n\n All limitations induced by the use of the Nexus CM SDK.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill all mandatory fields:\n\n Nexus CM DNS name * (string input) :\n\nURL to access the Nexus Certificate Manager.\n\n Nexus endpoint CA * (select) :\n\nSelect the endpoint CA.\n\n Nexus CM Certificate procedure name * (string input) :\n\nThe token procedure name to use.\n\nShould point to the appropriate certificate procedure, and must be on PKCS#10 format.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Nexus Certificate Manager PKI connector.\n\n MSAD Certificate Services\n OpenTrust PKI", - "keywords": [ - "nexus", - "certificate", - "manager", - "pki", - "admin-guide", - "admin-guide/connectors/nexus", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:otpki", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "OpenTrust PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/otpki", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/otpki.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/otpki.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "OpenTrust PKI" - ], - "summary": "OpenTrust PKI Prerequisites A certificate profile should be created. An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned certificate profil", - "content": "OpenTrust PKI\n\n Prerequisites\n\n A certificate profile should be created.\n\n An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned certificate profile.\n\n Limitations\n\n Only the following fields are managed: commonName, userID, serialNumber, organizationalUnit, organization, country, adminEmail or contactEmail, msCertTemplateName and subjectAltNames DNS, IPadress, RFC822Name, msUPN and msGUID .\n\n For multi-valued fields (SAN DNS, IP address and RFC822Name), if more data items are provided than configured in OTPKI 'certificate template name', the exceeding items will be ignored.\n\n All limitations induced by the use of the RA SOAP Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n OTPKI RA Connector URL * (string input) :\n\nMust point to the \"RA\" connector URL.\n\n OTPKI Certificate template name * (string input) :\n\nThe OTPKI certificate template to use.\n\n OTPKI zone (string input) :\n\nSpecify a zone (if used).\n\n Contact email mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n SAN DNS mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n SAN Email mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n UID mapping (string input) :\n\nAllows to change the default fields names accordingly to certificate profiles.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nEnter the password used to secure the aforementioned PKCS#12.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the OpenTrust PKI connector.\n\n Nexus Certificate Manager\n Sectigo CMS", - "keywords": [ - "opentrust", - "pki", - "admin-guide", - "admin-guide/connectors/otpki", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:sectigo", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Sectigo CMS PKI", - "section": "admin-guide", - "slug": "admin-guide/connectors/sectigo", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/sectigo.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/sectigo.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "Sectigo CMS" - ], - "summary": "Sectigo CMS PKI Prerequisites For publicly trusted certificates, you need to validate the domain(s) for which you will issue certificates prior to their issuance. You need to retrieve the customerUri and the organizationId from Sectigo CMS.", - "content": "Sectigo CMS PKI\n\n Prerequisites\n\n For publicly trusted certificates, you need to validate the domain(s) for which you will issue certificates prior to their issuance.\n\n You need to retrieve the customerUri and the organizationId from Sectigo CMS.\n\n You need to create a technical account with appropriate permissions including the allow ssl auto approve permission. You need to set a password for the technical account.\n\n Limitations\n\n Only the subjectAltName DNS field is managed.\n\n The certificate Subject DN will be set to whatever is specified in the PKCS#10 CSR.\n\n All limitations induced by the use of the Sectigo CMS REST Connector.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n Details tab\n\n 8. Fill in all mandatory fields:\n\n Customer URI * (string input) :\n\nEnter the Customer URI. An integer is expected.\n\n Organization ID * (int input) :\n\nEnter the Organization ID.\n\n Profile (Certificate Type) * (string input) :\n\nEnter the Profile (Certificate Type). An integer is expected.\n\n Retry interval ( finite duration ) :\n\nPredefined interval of time before retrying to retrieve the certificate from Sectigo. Must be a valid finite duration. No default value is set.\n\n Valid Days ( finite duration ) :\n\nCertificate validity duration in days. Must be a valid finite duration. No default value is set.\n\n 9. Click on the next button.\n\n Authentication tab\n\n 10. Fill in the PKI-authentication fields:\n\n Login * (string input) :\n\nEnter your Sectigo CMS login.\n\n Password * (string input) :\n\nEnter your Sectigo CMS password.\n\n 11. Click on the save button.\n\n You can edit , duplicate or delete the Sectigo CMS PKI connector.\n\n OpenTrust PKI\n Local Accounts", - "keywords": [ - "sectigo", - "cms", - "pki", - "admin-guide", - "admin-guide/connectors/sectigo", - "horizon", - "admin", - "guide", - "pkis", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:connectors:stream", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "EverTrust Stream CA", - "section": "admin-guide", - "slug": "admin-guide/connectors/stream", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/connectors/stream.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/connectors/stream.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "EverTrust Stream CA" - ], - "summary": "EverTrust Stream CA Prerequisites A certificate template should be created in Stream for Horizon to enroll certificates upon. A dedicated Horizon account should be created in Stream and should have all lifecycle permissions on the desired C", - "content": "EverTrust Stream CA\n\n Prerequisites\n\n A certificate template should be created in Stream for Horizon to enroll certificates upon.\n\n A dedicated Horizon account should be created in Stream and should have all lifecycle permissions on the desired CA. The credentials of this account should be either login and password or a PKCS#12 authentication certificate.\n\n Create the PKI connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI from the drawer or card: PKI   PKI Connectors .\n\n 3. Click on .\n\n 4. Select the correct PKI type.\n\n 5. Click on the next button\n\n General tab\n\n 6. Fill in the common mandatory fields:\n\n Connector Name * (string input) :\n\nChoose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.\n\n Proxy (string select) :\n\nIf the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.\n\n PKI Queue (string select) :\n\nThe PKI Queue used to manage the PKI Requests (enrollment, revocation).\n\n Timeout ( finite duration ) :\n\nRepresents a predefined interval of time without a PKI response, when the time has passed \"Horizon\" will cease trying to establish the communication. Must be a valid finite duration.\n\n 7. Click on the next button\n\n 8. Fill all mandatory fields:\n\n Endpoint * (string input) :\n\nFill in the Stream endpoint url.\n\n Template * (sting input) :\n\nFill in the Stream certificate template to enroll upon.\n\n CA (string input) :\n\nFill in the Stream CA enrolling certificate (internal name).\n\n 9. Click on the next button.\n\n Authentication tab\n\n Authentication PKCS#12 * (import p12) :\n\nImport the PKCS#12 file containing the authentication certificate used to connect to the PKI.\n\n PKCS#12 Password * (string input) :\n\nPassword used to secure the aforementioned PKCS#12.\n\n Login * (string input) :\n\nEnter the login for the dedicated Horizon account on Stream.\n\n Password * (string input) :\n\nEnter the aforementioned account’s password .\n\n 10. Click on the save button.\n\n You can edit , duplicate or delete the Evertrust Stream PKI connector.\n\n EverTrust Integrated CA\n FISId", - "keywords": [ - "evertrust", - "stream", - "ca", - "admin-guide", - "admin-guide/connectors/stream", - "horizon", - "admin", - "guide", - "pkis", - "pki", - "connectors" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:discovery", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Discovery", - "section": "admin-guide", - "slug": "admin-guide/discovery", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/discovery.html", - "breadcrumbs": ["Horizon", "Admin guide", "Discovery"], - "summary": "Discovery This section details how to configure Discovery campaigns. An EverTrust Horizon Discovery campaign will contain all certificates discovered on a specific scope. A discovered certificate can be: An unknown certificate. > All cer", - "content": "Discovery\n\n This section details how to configure Discovery campaigns. An EverTrust Horizon Discovery campaign will contain all certificates discovered on a specific scope.\n\n A discovered certificate can be:\n\n An unknown certificate.\n\n> All certificate information will be stored and this certificate will appear as an ' unmanaged ' certificate.\n\n An already discovered certificate (due to another Discovery campaign).\n\n> Discovery campaign metadata will be added to the existing certificate.\n\n A managed certificate.\n\n> Discovery campaign metadata will be added to the existing certificate.\n\n How to create a Discovery Campaign\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Discovery from the drawer or card: Discovery .\n\n 3. Click on .\n\n 4. Fill in all mandatory fields.\n\n General tab\n\n Campaign name * (string input) :\n\nEnter a meaningful Discovery campaign name.\n\n Description (string input) :\n\nEnter Discovery campaign description.\n\n Enable (boolean) :\n\nEnable/Disable this Discovery campaign.\n\n Grading policy (select) :\n\nThe grading policy to apply to every discovered certificate on this campaign.\n\n Search (select) :\n\nSelect an authorization level to search this Discovery campaign.\n\n Feed (select) :\n\nSelect an authorization level to feed this Discovery campaign.\n\n Log event on success * (boolean) :\n\nEnable/Disable discovery event on success.\n\n Log event on failure * (boolean) :\n\nEnable/Disable discovery event on failure.\n\n Log event on warning * (boolean) :\n\nEnable/Disable discovery event on warning.\n\n Host tab\n\n Hosts (string input or int) :\n\nSpecify the target to scan. Can be hostname(s), IP address(es), IP range or CIDR address(es). It is possible to add several hostnames separated by commas.\n\n Port tab\n\n Ports (string input or int) :\n\nEnter the port(s) to scan on hosts. It is possible to add several ports separated by commas or to add a port range separated by an hyphen (ex: 1-1000 to go from 1 to 1000).\n\n Hosts and ports should only be set if you intend to perform a network scan using horizon-cli in order to discover the certificates. These parameters are ignored in all other discovery modes (local scan, third party import).\n\n 6. Click on the save button.\n\n You can edit , flush or delete the Discovery.\n\n How to flush a Discovery Campaign\n\n Flushing a Discovery campaign is the action to remove Discovery campaign reference from all discovered certificates.\n\n There are three different cases:\n\n If the certificate is not managed by Horizon (only discovered by a Discovery campaign) AND only referenced by the campaign you are willing to flush → The certificate will be removed from the Horizon database.\n\n If the certificate is not managed by Horizon but is referenced by at least another Discovery campaign → The certificate will NOT be removed from the database and only the Discovery metadata will be removed from the certificate.\n\n If the certificate is managed by Horizon → Only the Discovery metadata will be removed from the certificate.\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Discovery from the drawer or card: Discovery .\n\n 3. Click on .\n\n 4. Click on the Confirm button to perform the flush.\n\n Groupware\n Automation Introduction", - "keywords": [ - "discovery", - "admin-guide", - "admin-guide/discovery", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Introduction", - "section": "admin-guide", - "slug": "admin-guide/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/introduction.html", - "breadcrumbs": ["Horizon", "Admin guide", "Introduction"], - "summary": "Introduction Description Horizon is EverTrust’s Certificate lifecycle management solution and is powered up by: Akka BouncyCastle MongoDB Kamon Play! Framework Scala NGINX Vue.js Quasar This document is specific to Horizon version 2.4 . Sco", - "content": "Introduction\n\n Description\n\n Horizon is EverTrust’s Certificate lifecycle management solution and is powered up by:\n\n Akka\n\n BouncyCastle\n\n MongoDB\n\n Kamon\n\n Play! Framework\n\n Scala\n\n NGINX\n\n Vue.js\n\n Quasar\n\n This document is specific to Horizon version 2.4 .\n\n Scope\n\n This document is an administration guide detailing how to configure and operate Horizon.\n\n Out of Scope\n\n This document does not describe how to install and bootstrap a Horizon instance. Please refer to the installation guide for installation related tasks.\n\n Troubleshooting\n User Information", - "keywords": [ - "introduction", - "admin-guide", - "admin-guide/introduction", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:logging", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Logging", - "section": "admin-guide", - "slug": "admin-guide/logging", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/logging.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/logging.html", - "breadcrumbs": ["Horizon", "Admin guide", "Logging"], - "summary": "Logging Horizon is able to format output log thanks to logback . Horizon defines a default rolling file appender named RUN . The default configuration keeps the technical logs for 30 days into files with the following naming convention: hor", - "content": "Logging\n\n Horizon is able to format output log thanks to logback .\n\n Horizon defines a default rolling file appender named RUN .\n\n The default configuration keeps the technical logs for 30 days into files with the following naming convention:\n\n horizon.log-<yyyy-MM-dd>.log\n\n Those files are available under the /opt/horizon/var/log directory\n\n Directly sending logs to your syslog server\n\n 1. Access the EverTrust Horizon server through SSH with an account with administrative privileges;\n\n 2. Using an editor like vi, open the horizon-logback.xml file located at /opt/horizon/etc/horizon-logback.xml ;\n\n 3. Edit the appender named \"SYSLOG\" to change the IP address for the syslogHost to redirect to your own syslog server.\nAs an example, if your syslog server is on 192.168.1.2 and the Horizon logs must be processed by the LOCAL6 facility, the syslog appender should look like this:\n\n <appender name=\"SYSLOG\" class=\"ch.qos.logback.classic.net.SyslogAppender\">\n <syslogHost>192.168.1.2</syslogHost>\n <facility>LOCAL6</facility>\n <suffixPattern>%msg%n</suffixPattern>\n</appender>\n\n 4. Still in the horizon-logback.xml file, update any logger with the SYSLOG appender ref and ensure that the log level is set to \"INFO\":\n\n <logger name=\"event\" level=\"INFO\">\n <appender-ref ref=\"SYSLOG\"/>\n</logger>\n\n 5. Save your modifications and restart the Horizon service:\n\n $ systemctl restart horizon\n\n The functional logs from Horizon should now be received by your remote syslog server:\n\n horizon {\"code\": \"SERVICE-STOP\",\"details\":[{\"key\":\"horizonVersion\",\"value\":\"2.4.0\"},{\"key\":\"message\",\"value\":\"Service successfully stopped\"}],\"module\":\"service\",\"node\":\"horizon\",\"timestamp\":1674054152149,\"status\":\"success\"}\nhorizon {\"code\": \"SERVICE-START\",\"details\":[{\"key\":\"horizonVersion\",\"value\":\"2.4.0\"},{\"key\":\"message\",\"value\":\"Service successfully started\"}],\"module\":\"service\",\"node\":\"horizon\",\"timestamp\":1674054170567,\"status\":\"success\"}\n\n Using the local syslog server for filtering and forwarding\n\n Alternatively, you might want to use a local syslog instance to add grok filtering to your logs before forwarding them to your own syslog server.\nTo do so, ensure that you have a syslog instance running (like rsyslog ), then:\n\n 1. Access the EverTrust Horizon server through SSH with an account with administrative privileges;\n\n 2. With an editor like vi, edit the /etc/rsyslog.d/horizon.conf (or create it if it does not exist yet) to add this line:\n\n local6.* @REMOTE_SYSLOG_HOSTNAME\n\n Don’t forget to replace the REMOTE_SYSLOG_HOSTNAME to the IP or DNS name of your remote syslog server. As an example, if your syslog server is on 192.168.1.2, the line should look like this:\n\n local6.* @192.168.1.2\n\n Note that you must set up your syslog host to accept UDP traffic on a specific port (here, we are going to use the default port which is 514) and catch the local6 facility logs, however the configuration of your own syslog host is out of the scope of this document.\n\n 3. Edit the /etc/rsyslog.conf file to uncomment the module and input lines of the UDP section:\n\n #module(load=\"imudp\") # needs to be done just once\n#input(type=\"imudp\" port=\"514\")\n\n They should look like this after uncommenting:\n\n module(load=\"imudp\") # needs to be done just once\ninput(type=\"imudp\" port=\"514\")\n\n 4. Restart your syslog service:\n\n $ systemctl restart rsyslog\n\n JSON Logging\n\nThis is only available from Horizon v2.4.6\n\n 1. Access the EverTrust Horizon server through SSH with an account with administrative privileges;\n\n 2. Using an editor like vi, open the horizon-logback.xml file located at /opt/horizon/etc/horizon-logback.xml ;\n\n 3. To send the JSON logs to a syslog server: Edit or create the appender named \"JSON_SYSLOG\" to change the IP address for the syslogHost to redirect to your own syslog server.\nAs an example, if your syslog server is on 192.168.1.2 and the Horizon logs must be processed by the LOCAL6 facility, the syslog appender should look like this:\n\n <conversionRule conversionWord=\"syslogStart\" converterClass=\"ch.qos.logback.classic.pattern.SyslogStartConverter\"/>\n<appender name=\"JSON_SYSLOG\" class=\"net.logstash.logback.appender.LogstashUdpSocketAppender\">\n <host>192.168.1.2</host>\n <port>514</port>\n <layout class=\"net.logstash.logback.layout.LogstashLayout\">\n <prefix class=\"ch.qos.logback.classic.PatternLayout\">\n <pattern>%syslogStart{LOCAL6}</pattern>\n </prefix>\n <fieldNames>\n <timestamp>time</timestamp>\n <logger>logger</logger>\n <thread>thread</thread>\n <level>severity</level>\n <stackTrace>exception</stackTrace>\n </fieldNames>\n <customFields>{\"app\":\"horizon\", \"hostname\":\"${HOSTNAME}\"}</customFields>\n </layout>\n</appender>\n\n To send the JSON logs to the local console: Edit or create the appender named \"STDOUT\" to change the encoder to a JSON one.\nThe final configuration should look like this.\n\n <appender name=\"STDOUT\" class=\"ch.qos.logback.core.ConsoleAppender\">\n <encoder class=\"net.logstash.logback.encoder.LogstashEncoder\">\n <fieldNames>\n <timestamp>time</timestamp>\n <logger>logger</logger>\n <thread>thread</thread>\n <level>severity</level>\n <stackTrace>exception</stackTrace>\n </fieldNames>\n <customFields>{\"app\":\"horizon\", \"hostname\":\"${HOSTNAME}\"}</customFields>\n </encoder>\n </appender>\n\n 4. Still in the horizon-logback.xml file, update any logger with the appender ref and ensure that the log level is not OFF:\n\n <logger name=\"event\" level=\"INFO\">\n <appender-ref ref=\"JSON_SYSLOG\"/>\n</logger>\n\n or\n\n <logger name=\"controllers\" level=\"INFO\">\n <appender-ref ref=\"STDOUT\"/>\n</logger>\n\n 5. Save your modifications and restart the Horizon service:\n\n $ systemctl restart horizon\n\n The functional logs from Horizon should now be in JSON Format:\n\n Console : {\"time\": \"2023-08-16T16:12:54.481+02:00\",\"@version\":\"1\",\"message\":\"[Actor pkimanager] - Registering PKI Queue 'slowed-queue' (cluster wide: 'false')\",\"logger\":\"actors.pki.PKIManagerActor\",\"thread\":\"application-blocking-io-dispatcher-43\",\"severity\":\"INFO\",\"level_value\":20000,\"HOSTNAME\":\"horizon.evertrust\",\"application.home\":\"/opt/horizon\",\"kamonSpanId\":\"c5a74b959971c7ee\",\"kamonTraceId\":\"b1ccb54c9eb7e493\",\"kamonSpanName\":\"/ui\",\"app\":\"horizon\",\"hostname\":\"horizon.evertrust\"}\nSyslog : 2023-08-16T16:12:54+02:00 horizon.evertrust {\"time\": \"2023-08-16T16:12:54.482+02:00\",\"@version\":\"1\",\"message\":\"[Actor pkimanager] - Registering PKI Queue 'test' (cluster wide: 'false')\",\"logger\":\"actors.pki.PKIManagerActor\",\"thread\":\"application-blocking-io-dispatcher-43\",\"severity\":\"INFO\",\"level_value\":20000,\"HOSTNAME\":\"horizon.evertrust\",\"application.home\":\"/opt/horizon\",\"kamonSpanId\":\"c5a74b959971c7ee\",\"kamonTraceId\":\"b1ccb54c9eb7e493\",\"kamonSpanName\":\"/ui\",\"app\":\"horizon\",\"hostname\":\"horizon.evertrust\"}\n\n Overridable configuration parameters\n Introduction", - "keywords": [ - "logging", - "admin-guide", - "admin-guide/logging", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:notifications:groupware", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Groupware", - "section": "admin-guide", - "slug": "admin-guide/notifications/groupware", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/notifications/groupware.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/notifications/groupware.html", - "breadcrumbs": ["Horizon", "Admin guide", "Notifications", "Groupware"], - "summary": "Groupware This section details how to configure the groupware notifications. The supported groupwares are: Slack Mattermost Microsoft Teams Prerequisites You will need a webhook URL from the groupware tools in order to send notification: Sl", - "content": "Groupware\n\n This section details how to configure the groupware notifications.\n\n The supported groupwares are:\n\n Slack\n\n Mattermost\n\n Microsoft Teams\n\n Prerequisites\n\n You will need a webhook URL from the groupware tools in order to send notification:\n\n Slack\n\n Mattermost\n\n Microsoft Teams\n\n How to create a Groupware notification\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Groupware from the drawer or card: Notifications   Groupware .\n\n 3. Click on .\n\n 4. Fill in all mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful email notification name.\n\n Event type * (select) :\n\nSelect the event type to notify (certificate or request).\n\n Event * (select) :\n\nSelect the event to notify.\n\n Retries in case of error (int) :\n\nSelect the number of times Horizon should retry to send the notification in case of error. The default value is set to 10.\n\n Timeout * ( finite duration ) :\n\nThe time before Horizon stop trying to connect to Webhook or Proxy.\n\n Proxy (string select) :\n\nThe HTTP/HTTPS proxy to use to reach the groupware tool, if any.\n\n To * (select) :\n\nSelect one of:\n\n Static\n\n Groupware * (select) :\n\nSelect the groupware on which to send the message. Supported options are:\n\n Slack\n\n Mattermost\n\n Microsoft Teams\n\n URL * (select) :\n\nThe webhook URL allowing the publication of messages. See the prerequisites to obtain one.\n\n Teams webhook\n\n Title * (string input) :\n\nEnter the title of the instant message. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon notification generation.\n\n Body * (string input) :\n\nEnter the body of the instant message. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon notification generation.\n\n You can click on the \"+\" next to \"How to use dynamic attributes\" in order to get a range of possibilities from which one or more may be chosen.\n\n In case you selected as an Event Certificate Expiration :\n\n Duration before certificate expiration causing the notification * ( finite duration ) :\n\nSets how long before certificate expiration the groupware notification should be sent. The default value is set to 5 days.\n\n In case you selected as an Event Enroll request Pending or Renew request Pending or Revoke request Pending or Recover request Pending or Update request Pending or Migrate request Pending :\n\n Duration after request submission causing the notification * ( finite duration ) :\n\nDuration after request submission causing the groupware notification to be sent, in case the request was not approved in the meantime. The default value is set to 5 days.\n\n 6. Click on the save button.\n\n You can edit , duplicate or delete the Groupware Notification.\n\n Email\n Discovery", - "keywords": [ - "groupware", - "admin-guide", - "admin-guide/notifications/groupware", - "horizon", - "admin", - "guide", - "notifications" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:notifications:mail", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Email", - "section": "admin-guide", - "slug": "admin-guide/notifications/mail", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/notifications/mail.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/notifications/mail.html", - "breadcrumbs": ["Horizon", "Admin guide", "Notifications", "Email"], - "summary": "Email This section details how to configure the email notifications. How to create an email notification 1. Log in to Horizon Administration Interface. 2. Access emails from the drawer or card: Notifications Emails . 3. Click on . 4. Fill i", - "content": "Email\n\n This section details how to configure the email notifications.\n\n How to create an email notification\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access emails from the drawer or card: Notifications   Emails .\n\n 3. Click on .\n\n 4. Fill in all mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful email notification name.\n\n Event type * (select) :\n\nSelect the event type to notify (certificate or request).\n\n Event * (select) :\n\nSelect the event to notify.\n\n Retries in case of error (int) :\n\nSelect the number of times Horizon should retry to send the notification in case of error. The default value is set to 10.\n\n From *: (string input)\n\nEnter the email address that will appear in the email \"From\" field.\n\n To *: (select multiple & input multiple)\n\nSelect one or several recipients. You may also enter an email address.\n\n Subject * (string input) :\n\nEnter the email subject. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon email generation.\n\n Body * (string input) :\n\nEnter the email body. You may use dynamic attributes, that will be automatically replaced by the appropriate values upon email generation.\n\n Is HTML (boolean) :\n\nSets whether the email body contains HTML code (true) or plain text (false). The default value is set to false.\n\n You can click on the \"+\" next to \"How to use dynamic attributes\" in order to get a range of possibilities from which one or more may be chosen.\n\n In case you selected a Request type event on any Approval event, or a Certificate event:\n\n Attachments (list) :\n\nSets whether to attach the certificate to the email notification and which format to use for the attached certificate (if any).\n\n Attach certificate (PEM) attaches the certificate under PEM format\n\n Attach bundle (PEM) attaches the certificate as well as the entire trust chain used to sign it in PEM format\n\n Attach certificate (PKCS#7) attaches the certificate under PKCS#7 format\n\n Attach bundle (PKCS#7) attaches the certificate as well as the entire trust chain used to sign it in PKCS#7 format\n\n Attach certificate (DER) attaches the certificate under DER format\n\n In case you selected Certificate Expiration :\n\n Duration before certificate expiration causing the notification * ( finite duration ) :\n\nSets how long before certificate expiration the email notification should be sent. The default value is set to 5 days.\n\n Run on renewed (boolean) :\n\nSets whether the expiration notification should be sent even though the certificate has been renewed. Default value is set to false (if the certificate has been renewed, the notification will not be sent).\n\n In case you selected as an Event Enroll request Approval or Renew request Approval or Recover request Approval :\n\n Attach PKCS#12 (set at false) (boolean) :\n\nSets whether the certificate in PKCS#12 format (certificate + private key encrypted by password) should be attached to the email. The default value is set to false.\n\n Send email if (select unique) :\n\nSelect either Always - Centralized (Horizon generates the private key) - Decentralized (a CSR is provided to Horizon). The default value is set to Always.\n\n In case you selected as an Event Enroll request Pending or Renew request Pending or Revoke request Pending or Recover request Pending or Update request Pending or Migrate Request Pending :\n\n Duration after request submission causing the notification * ( finite duration ) :\n\nDuration after request submission causing the notification to be sent, in case the request was not approved in the meantime. The default value is set to 5 days.\n\n 6. Click on the save button.\n\n You can edit , duplicate or delete the Email Notification .\n\n Teams\n Groupware", - "keywords": [ - "email", - "admin-guide", - "admin-guide/notifications/mail", - "horizon", - "admin", - "guide", - "notifications" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:other:cron", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Cron Expression", - "section": "admin-guide", - "slug": "admin-guide/other/cron", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/other/cron.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/other/cron.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Common configuration elements", - "Cron Expression" - ], - "summary": "Cron Expression Cron expressions are composed of 6 required fields and one optional field separated by white spaces. The fields are respectively described as follows: Field Name Allowed Values Allowed Special Character Seconds 0-59 - * / Mi", - "content": "Cron Expression\n\n Cron expressions are composed of 6 required fields and one optional field separated by white spaces. The fields are respectively described as follows:\n\n Field Name\n Allowed Values\n Allowed Special Character\n\n Seconds\n\n 0-59\n\n - * /\n\n Minutes\n\n 0-59\n\n - * /\n\n Hours\n\n 0-23\n\n - * /\n\n Day-of-month\n\n 1-31\n\n - * ? / L W\n\n Month\n\n 1-12 or JAN-DEC\n\n - *\n\n Day-of-Week\n\n 1-7 or SUN-SAT\n\n - * ? / L #\n\n Year (Optional)\n\n empty, 1970-2199\n\n - * /\n\n Special characters\n\n * (\"all values\") - used to select all values within a field. For\nexample, \"*\" in the minute field means every minute .\n\n ? (\"no specific value\") - useful when you need to specify something\nin one of the two fields in which the character is allowed, but not the\nother. For example, if I want my trigger to fire on a particular day of\nthe month (say, the 10th), but don’t care what day of the week that\nhappens to be, I would put \"10\" in the day-of-month field, and \"?\" in\nthe day-of-week field. See the examples below for clarification.\n\n - - used to specify ranges. For example, \"10-12\" in the hour field\nmeans \"the hours 10, 11 and 12\".\n\n , - used to specify additional values. For example, \"MON,WED,FRI\" in\nthe day-of-week field means \"the days Monday, Wednesday, and Friday\".\n\n / - used to specify increments. For example, \"0/15\" in the seconds\nfield means \"the seconds 0, 15, 30, and 45\". And \"5/15\" in the seconds\nfield means \"the seconds 5, 20, 35, and 50\". You can also specify '/'\nafter the '*' character - in this case '*' is equivalent to having '0'\nbefore the '/'. '1/3' in the day-of-month field means \"fire every 3 days\nstarting on the first day of the month\".\n\n L (\"last\") - has different meaning in each of the two fields it is allowed\ninto. For example, the value \"L\" in the day-of-month\nfield means \"the last day of the month\" - day 31 for January, day 28 for\nFebruary on non-leap years. If used in the day-of-week field by itself,\nit simply means \"7\" or \"SAT\". But if used in the day-of-week field after\nanother value, it means \"the last xxx day of the month\" - for example\n\"6L\" means \"the last Friday of the month\". You can also specify an\noffset from the last day of the month, such as \"L-3\" which would mean\nthe third-to-last day of the calendar month. When using the 'L' option,\nit is important not to specify lists, or ranges of values, as you’ll get\nconfusing/unexpected results.\n\n W (\"weekday\") - used to specify the weekday (Monday-Friday) nearest\nthe given day. As an example, if you were to specify \"15W\" as the value\nfor the day-of-month field, the meaning is: \"the nearest weekday to the\n15th of the month\". So if the 15th is a Saturday, the trigger will fire\non Friday the 14th. If the 15th is a Sunday, the trigger will fire on\nMonday the 16th. If the 15th is a Tuesday, then it will fire on Tuesday\nthe 15th. However if you specify \"1W\" as the value for day-of-month, and\nthe 1st is a Saturday, the trigger will fire on Monday the 3rd, as it\nwill not 'jump' over the boundary of a month’s days. The 'W' character\ncan only be specified when the day-of-month is a single day, not a range\nor list of days.\n\n # - used to specify \"the nth\" XXX day of the month. For example, the\nvalue of \"6#3\" in the day-of-week field means \"the third Friday of the\nmonth\" (day 6 = Friday and \"#3\" = the 3rd one in the month). Other\nexamples: \"2#1\" = the first Monday of the month and \"4#5\" = the fifth\nWednesday of the month. Note that if you specify \"#5\" and there is not 5\nof the given day-of-week in the month, then no firing will occur that\nmonth.\n\n The 'L' and 'W' characters can also be combined\nin the day-of-month field to yield ' LW ', which translates to \"last\nweekday of the month\" .\n\n Grading Rules\n Finite Duration", - "keywords": [ - "cron", - "expression", - "admin-guide", - "admin-guide/other/cron", - "horizon", - "admin", - "guide", - "common", - "configuration", - "elements" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:other:dictionary_entries", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Dictionaries", - "section": "admin-guide", - "slug": "admin-guide/other/dictionary_entries", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/other/dictionary_entries.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/other/dictionary_entries.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Common configuration elements", - "Dictionaries" - ], - "summary": "Dictionaries Here is the list of available dictionary keys to use in computation rules , depending on the usage. General The dictionary keys listed here are available in all protocols. All indexes start at 1. Principal This dictionary regro", - "content": "Dictionaries\n\n Here is the list of available dictionary keys to use in computation rules , depending on the usage.\n\n General\n\n The dictionary keys listed here are available in all protocols.\n\nAll indexes start at 1.\n\n Principal\n\n This dictionary regroups the information of the user making the request, the 'principal'.\n\n Key\n Description\n Type\n\n principal.identifier\n\n The identifier of the user\n\n Single value\n\n principal.team\n\n The teams of the user\n\n Multi valued\n\n principal.team.<index>\n\n The team at index index\n\n Single value\n\n principal.name\n\n The name of the user\n\n Single value\n\n principal.mail\n\n The email of the user\n\n Single value\n\n principal.provider.name\n\n The name of the identity provider of the principal\n\n Single value\n\n principal.certificate.subject\n\n The values of the principal certificate subject\n\n Subject dictionary\n\n principal.certificate.san\n\n The values of the principal certificate sans\n\n Sans dictionary\n\n principal.certificate.extension\n\n The values of the principal certificate extensions\n\n Extensions dictionary\n\n CSR\n\n This dictionary regroups the information of the csr used for enrollment. It can be sent via a client (horizon-cli, estclient, sscep) or via web interfaces with WebRA protocol.\n\nThis only concerns decentralized enrollment.\n\n Key\n Description\n Type\n\n csr.subject\n\n The values of the csr subject\n\n Subject dictionary\n\n csr.san\n\n The values of the csr sans\n\n Sans dictionary\n\n csr.extension\n\n The values of the csr extensions\n\n Extensions dictionary\n\n WebRA\n\n Enrollment request\n\n Certificate fields can be filled by the user on Horizon interface. This information is available through the following dictionary.\n\n Key\n Description\n Type\n\n webra.enroll.subject\n\n The values of the subject defined in the challenge request\n\n Subject dictionary\n\n webra.enroll.san\n\n The values of the sans defined in the challenge request\n\n Sans dictionary\n\n webra.enroll.extension\n\n The values of the extensions defined in the challenge request\n\n Extensions dictionary\n\n webra.enroll.label.<label name>\n\n The value of label label name defined in the challenge request\n\n Single value\n\n webra.enroll.metadata.<metadata name>\n\n The value of metadata metadata name defined in the challenge request\n\n Single value\n\n webra.enroll.mail\n\n The value of the contact email defined in the challenge request\n\n Single value\n\n webra.enroll.owner\n\n The value of the owner defined in the challenge request\n\n Single value\n\n webra.enroll.team\n\n The value of the team defined in the challenge request\n\n Single value\n\n EST\n\n Enrollment request\n\n In case of a prevalidated enroll, certificate fields can be filled by the user on Horizon interface. This information is available through the following dictionary.\n\n Key\n Description\n Type\n\n est.enroll.subject\n\n The values of the subject defined in the challenge request\n\n Subject dictionary\n\n est.enroll.san\n\n The values of the sans defined in the challenge request\n\n Sans dictionary\n\n est.enroll.extension\n\n The values of the extensions defined in the challenge request\n\n Extensions dictionary\n\n est.enroll.label.<label name>\n\n The value of label label name defined in the challenge request\n\n Single value\n\n est.enroll.metadata.<metadata name>\n\n The value of metadata metadata name defined in the challenge request\n\n Single value\n\n est.enroll.mail\n\n The value of the contact email defined in the challenge request\n\n Single value\n\n est.enroll.owner\n\n The value of the owner defined in the challenge request\n\n Single value\n\n est.enroll.team\n\n The value of the team defined in the challenge request\n\n Single value\n\n URL passed parameters\n\n Horizon allows the use of URL parameters to pass certificate metadata info.\nThese are notably used by the horizon-cli client.\n\n Key\n Description\n Type\n\n url.enroll.label.<label name>\n\n The value of label label name passed in the URL\n\n Single value\n\n url.enroll.metadata.<metadata name>\n\n The value of metadata metadata name passed in the URL\n\n Single value\n\n url.enroll.mail\n\n The value of the contact email passed in the URL\n\n Single value\n\n url.enroll.owner\n\n The value of the owner passed in the URL\n\n Single value\n\n url.enroll.team\n\n The value of the team passed in the URL\n\n Single value\n\n SCEP\n\n Enrollment request\n\n In case of a prevalidated enroll, certificate fields can be filled by the user on Horizon interface. This information is available through the following dictionary.\n\n Key\n Description\n Type\n\n scep.enroll.subject\n\n The values of the subject defined in the challenge request\n\n Subject dictionary\n\n scep.enroll.san\n\n The values of the sans defined in the challenge request\n\n Sans dictionary\n\n scep.enroll.extension\n\n The values of the extensions defined in the challenge request\n\n Extensions dictionary\n\n scep.enroll.label.<label name>\n\n The value of label label name defined in the challenge request\n\n Single value\n\n scep.enroll.metadata.<metadata name>\n\n The value of metadata metadata name defined in the challenge request\n\n Single value\n\n scep.enroll.mail\n\n The value of the contact email defined in the challenge request\n\n Single value\n\n scep.enroll.owner\n\n The value of the owner defined in the challenge request\n\n Single value\n\n scep.enroll.team\n\n The value of the team defined in the challenge request\n\n Single value\n\n URL passed parameters\n\n Horizon allows the use of URL parameters to pass certificate metadata info.\nThese are notably used by the horizon-cli client.\n\n Key\n Description\n Type\n\n url.enroll.label.<label name>\n\n The value of label label name passed in the URL\n\n Single value\n\n url.enroll.metadata.<metadata name>\n\n The value of metadata metadata name passed in the URL\n\n Single value\n\n url.enroll.mail\n\n The value of the contact email passed in the URL\n\n Single value\n\n url.enroll.owner\n\n The value of the owner passed in the URL\n\n Single value\n\n url.enroll.team\n\n The value of the team passed in the URL\n\n Single value\n\n ACME\n\n Order\n\n This dictionary regroups the information of the acme order used for enrollment.\n\n Key\n Description\n Type\n\n acme.order.initialip\n\n The initial IP of the acme order\n\n Single value\n\n acme.order.label.<label name>\n\n The value of label label name\n\n Single value\n\n acme.order.metadata.<metadata name>\n\n The value of metadata metadata name\n\n Single value\n\n acme.order.mail\n\n The value of the contact email of the acme order\n\n Single value\n\n acme.order.owner\n\n The value of the owner of the acme order\n\n Single value\n\n acme.order.team\n\n The value of the team of the acme order\n\n Single value\n\n Account\n\n This dictionary regroups the information of the acme account used for enrollment.\n\n Key\n Description\n Type\n\n acme.account.initialip\n\n The initial IP of the acme account\n\n Single value\n\n acme.account.contact.<index>\n\n The value of contact email address of the account at index index\n\n Single value\n\n CRMP\n\n Enrollment request\n\n Certificate fields can be filled by the user on CMS interface. This information is available through the following dictionary.\n\n Key\n Description\n Type\n\n crmp.enroll.subject\n\n The values of the subject defined in the challenge request\n\n Subject dictionary\n\n crmp.enroll.san\n\n The values of the sans defined in the challenge request\n\n Sans dictionary\n\n crmp.enroll.extension\n\n The values of the extensions defined in the challenge request\n\n Extensions dictionary\n\n crmp.enroll.label.<label name>\n\n The value of label label name defined in the challenge request\n\n Single value\n\n crmp.enroll.metadata.<metadata name>\n\n The value of metadata metadata name defined in the challenge request\n\n Single value\n\n crmp.enroll.mail\n\n The value of the contact email defined in the challenge request\n\n Single value\n\n crmp.enroll.owner\n\n The value of the owner defined in the challenge request\n\n Single value\n\n crmp.enroll.team\n\n The value of the team defined in the challenge request\n\n Single value\n\n WCCE\n\n Caller identity\n\n The information of the caller identity in a WCCE enroll.\n\n Key\n Description\n Type\n\n calleridentity.dn\n\n The dn of the caller identity\n\n Single value\n\n calleridentity.cn\n\n The cn of the caller identity\n\n Single value\n\n calleridentity.msguid\n\n The guid of the caller identity\n\n Single value\n\n calleridentity.msupn\n\n The upn of the caller identity\n\n Single value\n\n calleridentity.c\n\n The country of the caller identity\n\n Single value\n\n calleridentity.company\n\n The company of the caller identity\n\n Single value\n\n calleridentity.department\n\n The department of the caller identity\n\n Single value\n\n calleridentity.description\n\n The description of the caller identity\n\n Single value\n\n calleridentity.displayname\n\n The display name of the caller identity\n\n Single value\n\n calleridentity.dnshostname\n\n The dns host name of the caller identity\n\n Single value\n\n calleridentity.employeeid\n\n The employee id of the caller identity\n\n Single value\n\n calleridentity.employeenumber\n\n The employee number of the caller identity\n\n Single value\n\n calleridentity.mail\n\n The email of the caller identity\n\n Single value\n\n calleridentity.o\n\n The organization of the caller identity\n\n Single value\n\n calleridentity.ou\n\n The OU of the caller identity\n\n Single value\n\n calleridentity.samaccountname\n\n The sam account name of the caller identity\n\n Single value\n\n calleridentity.serialnumber\n\n The serial number of the caller identity\n\n Single value\n\n calleridentity.sn\n\n The sn of the caller identity\n\n Single value\n\n calleridentity.title\n\n The title of the caller identity\n\n Single value\n\n calleridentity.uid\n\n The uid of the caller identity\n\n Single value\n\n calleridentity.sid\n\n The sid of the caller identity\n\n Single value\n\n Sub dictionaries\n\n These dictionary cannot be used alone but can be completed with one of the other ones. For example, a valid key is:\n\n principal.certificate.subject.cn.1\n\n Subject dictionary\n\n Key\n Description\n Type\n\n subject.<dn field type>\n\n All values of subject field of type dn field type\n\n Multi valued\n\n subject.<dn field type>.<index>\n\n Value of subject field of type dn field type at index index\n\n Single value\n\nThe valid dn field types are: cn, uid, serialnumber, surname, givenname, unstructuredaddress, unstructuredname, e, ou, organizationidentifier, uniqueidentifier, street, st, l, o, c, description, dc.\n\n Sans dictionary\n\n Key\n Description\n Type\n\n san.<san field type>\n\n All values of SAN fields of type san field type\n\n Multi valued\n\n san.<san field type>.<index>\n\n Value of subject field of type san field type at index index\n\n Single value\n\nThe valid SAN field types are: rfc822name , dnsname , uri , ipaddress , othername_upn , othername_guid .\n\n Extensions dictionary\n\n Key\n Description\n Type\n\n extension.<extension type>\n\n Value of extension of type extension type\n\n Single value\n\nThe valid extension types are: ms_sid , ms_template .\n\n Regex\n Computation rule", - "keywords": [ - "dictionaries", - "admin-guide", - "admin-guide/other/dictionary_entries", - "horizon", - "admin", - "guide", - "common", - "configuration", - "elements" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:other:duration", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Finite Duration", - "section": "admin-guide", - "slug": "admin-guide/other/duration", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/other/duration.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/other/duration.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Common configuration elements", - "Finite Duration" - ], - "summary": "Finite Duration The format of a Finite Duration is \"<length><unit>\" , where: White space is allowed between the parts. Length is a positive integer without the \"+\" sign. Valid possible units are described in the below table: Uni", - "content": "Finite Duration\n\n The format of a Finite Duration is \"<length><unit>\" , where:\n\n White space is allowed between the parts.\n\n Length is a positive integer without the \"+\" sign.\n\n Valid possible units are described in the below table:\n\n Unit\n Short name\n Long names\n\n DAYS\n\n d\n\n day days\n\n HOURS\n\n h\n\n hour hours\n\n MINUTES\n\n m\n\n min mins minute minutes\n\n SECONDS\n\n s\n\n sec secs second seconds\n\n MILLISECONDS\n\n ms\n\n milli millis millisecond milliseconds\n\n For example, 10 seconds will be written as \"10 s\", \"10s\", \"10 sec\" or \"10 seconds\".\n\n Cron Expression\n Regex", - "keywords": [ - "finite", - "duration", - "admin-guide", - "admin-guide/other/duration", - "horizon", - "admin", - "guide", - "common", - "configuration", - "elements" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:other:regex", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Regex", - "section": "admin-guide", - "slug": "admin-guide/other/regex", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/other/regex.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/other/regex.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Common configuration elements", - "Regex" - ], - "summary": "Regex Regex are a powerful tool to match patterns in strings.Horizon is developed in Java, so regex must follow the Java regex engine syntax. In Horizon, most regex input are used for validation of a field input.As such, they validate one l", - "content": "Regex\n\n Regex are a powerful tool to match patterns in strings.Horizon is developed in Java, so regex must follow the Java regex engine syntax.\n\n In Horizon, most regex input are used for validation of a field input.As such, they validate one line, and a good practice is enforced:\n\nRegex must start with ^ and end with $ .\n\n Finite Duration\n Dictionaries", - "keywords": [ - "regex", - "admin-guide", - "admin-guide/other/regex", - "horizon", - "admin", - "guide", - "common", - "configuration", - "elements" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:other:template_string", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Computation rule", - "section": "admin-guide", - "slug": "admin-guide/other/template_string", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/other/template_string.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.5/admin-guide/other/template_string.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Common configuration elements", - "Computation rule" - ], - "summary": "Computation rule Computation Rules are expressions that describe operations to apply to dictionary keys. These keys can come from diverse data sources such as a certification request or a user entry. The available operations and their usage", - "content": "Computation rule\n\n Computation Rules are expressions that describe operations to apply to dictionary keys. These keys can come from diverse data sources such as a certification request or a user entry. The available operations and their usage are detailed in this part.\n\n Example\n\n Let’s start by an example:\n\n My CSR contains a DNSNAME subject alternate name with the following value:\n\n host.evertrust.fr\n\n I want my final certificate to have 2 SANs, this value and its short name: \"host\".\n\n In order to do that, in Profile   Certificate Template   Subject Alternate Names , I add a DNSNAME SAN with the following computation rule:\n\n [{{csr.san.dnsname.1}}, Extract({{csr.san.dnsname.1}}, \"(.*?)\\.\", 1)]\n\n This will output, in my final certificate, two SANs with values:\n\n host.evertrust.fr, host\n\n To explain this result, the value \"host.evertrust.fr\" was retrieved by choosing the first DNSNAME SAN of the CSR: {{csr.san.dnsname.1}} .\nThe function Extract extracted the first catching group from the regex (.*?)\\. , resulting in the \"host\" value.\n\n The computation rule language has a lot more possible operations, allowing complex use cases to become reality.\n\n Dictionary keys\n\n Dictionary keys are a way to name the information from the available sources.\nFor instance, for a webra enroll, the available sources are the given csr, the webra enroll form data and the principal information if it is authenticated.\nThe full list of available dictionary keys is available on the dictionary page .\n\n Enrollment\n\n A key can reference a single element or a list of elements.\nIt is separated in three main parts: the source of data (csr, webra enroll data form), the section of the data, and an optional number\n\n For example, the following is a valid key with these 3 parts:\n\n {{ csr . subject.cn . 1 }}\n\n The csr is the data source, the subject.cn the requested information and the 1 is the index. It allows to retrieve the first , common name from the subject , from the CSR .\n\n Without an index, the key is still valid, but it will output all the corresponding values. For example\n\n [[ csr . subject.ou ]]\n\n This retrieves all the ou from the subject , from the CSR .\n\nWhen a key is expected to output a single value it should be written as a single dictionary key, and one outputting a list of values as a multi dictionary key, otherwise it will be none.\n\n Basic expressions\n\n Basic string expressions\n\nThe following expressions are evaluated as a string or None.\n\n Expression Name\n Syntax\n Allowed Values\n Description\n Example\n\n Single dictionary key\n\n {{<key>}}\n\n key: a-zA-A-._\n\n This retrieves a key value from the dictionary, none if it does not exist\n\n {{csr.subject.cn.1}}\n\n Number\n\n <number>\n\n number: -\\d+\n\n This will output the given number\n\n -4\n\n Literal\n\n \"<literal>\"\n\n literal: any string\n\n This will output the given literal\n\n \"iAmAString\"\n\n Null\n\n NULL\n\n NULL\n\n This will output None\n\n NULL\n\n Basic list expressions\n\nThe following expressions are evaluated as a list of string or None.\n\n Expression Name\n Syntax\n Allowed Values\n Description\n Example\n\n Multi dictionary key\n\n [[<key>]]\n\n key: a-zA-A-._\n\n This retrieves all values that start with key from the dictionary\n\n [[csr.subject.cn]]\n\n Array\n\n [<simpleExpression>, …​<simpleExpression>]\n\n simpleExpression: any expression that will be evaluated to a single element\n\n This will output a multi expression composed of all inserted simple expressions\n\n [\"iAmAString\", {{csr.san.dnsname.1}}]\n\n Quick reference\n\nFunction names are not case sensitive but keys are\n\n Function Name\n Syntax\n\n Upper\n\n Upper( expression :<expression>)\n\n Lower\n\n Lower( expression :<expression>)\n\n Trim\n\n Trim( expression : <expression>)\n\n Substr\n\n Substr( expression : <expression>, start : <number>)\n\n Substr\n\n Substr( expression : <expression>, start : <number>, end : <number>)\n\n Concat\n\n Concat( expression : <expression>, …​<expression>)\n\n Extract\n\n Extract( expression : <expression>, regex : <literal>)\n\n Extract\n\n Extract( expression : <expression>, regex : <literal>, group : <number>)\n\n Replace\n\n Replace( expression : <expression>, regex : <literal>, replacement : <expression>)\n\n OrElse\n\n OrElse( expression : <expression>, …​<expression>)\n\n Match\n\n Match( expression : <simpleExpression>, regex : <literal>)\n\n Get\n\n Get( expression : <multiExpression>, index : <number>)\n\n First\n\n First( expression : <multiExpression>)\n\n Last\n\n Last( expression : <multiExpression>)\n\n Filter\n\n Filter( expression : <multiExpression>, regex : <literal>)\n\n Slice\n\n Slice( expression : <multiExpression>, start : <number>)\n\n Slice\n\n Slice( expression : <multiExpression>, start : <number>, end : <number>)\n\n Any expression functions\n\n Upper\n\n Upper(expression:<expression>)\n\n This outputs the result evaluated from expression with only upper case characters and None if no value was evaluated\n\n Upper(\"string\") => \"STRING\"\nUpper([\"string1\", \"string2\"]) => [\"STRING1\", \"STRING2\"]\n\n Lower\n\n Lower(expression:<expression>)\n\n This outputs the result evaluated from expression with only lower case characters and None if no value was evaluated\n\n Lower(\"STRING\") => \"string\"\nLower([\"STRING1\", \"STRING2\"]) => [\"string1\", \"string2\"]\n\n Trim\n\n Trim(expression:<expression>)\n\n This outputs the trimmed result evaluated from expression and None if no value was evaluated\n\n Trim(\" STRING\") => \"STRING\"\nTrim([\"string1 \", \" string2 \"]) => [\"string1\", \"string2\"]\n\n Substr\n\n Substr(expression: <expression>, start: <number>)\n\n This outputs the substring from index start to the end of the string evaluated from expression and None if no value was evaluated or the result of substring is empty. start can be negative and it will be computed from end of string.\n\n Substr(\"STRING\", 2) => \"TRING\"\nSubstr([\"string\", \"longerString\", \"s\"], -2) => [\"ng\", \"ng\", \"s\"]\nSubstr(\"tooShort\", 15) => None\n\n Substr\n\n Substr(expression: <expression>, start: <number>, end: <number>)\n\n This outputs the substring from index start to end of the string evaluated from expression and None if no value was evaluated or the result of substring is empty. start and end can be negative and it will be computed from end of string.\n\n Substr(\"STRING\", 2, 4) => \"TRI\"\nSubstr([\"string\", \"longerString\", \"s\"], 2, -2) => [\"tri\", \"ongerStri\"]\nSubstr(\"tooShort\", -2, 4) => None\n\n Concat\n\n Concat(expression: <expression>, ...<expression>)\n\n This outputs the concatenation of evaluated expressions: if they are all simple expression, a string concatenation will take place, otherwise an array with all the values will be evaluated. If the final result is empty, None will be returned.\n\n Concat(\"start\", \" middle \", \"end\") => \"start middle end\"\nConcat([\"string1\", \"string2\", \"string3\"], \"string4\") => [\"string1\", \"string2\", \"string3\", \"string4\"]\n\n Extract\n\n Extract(expression: <expression>, regex: <literal>)\n\n This extracts from the evaluated expression string(s) the part that matches the regex\n\n Extract(\" [email protected] \", \".*@\") => \"abcd@\"\nExtract([\"string1\", \"string2\", \"string3\"], \"\\d\") => [\"1\", \"2\", \"3\"]\n\n Extract\n\n Extract(expression: <expression>, regex: <literal>, group: <number>)\n\n This extracts from the evaluated expression string(s) the group at index group that matches the regex\n\n Extract(\" [email protected] \", \"(.*)@\", 1) => \"abcd\"\nExtract([\"string1\", \"string2\", \"string3\"], \"(.*)\\d\", 1) => [\"string\", \"string\", \"string\"]\n\n Replace\n\n Replace(expression: <expression>, regex: <literal>, replacement: <expression>)\n\n This replaces parts of the evaluated expression string(s) that matches the regex with the evaluated replacement . If replacement is None, values will be replaced by an empty string.\n\n Replace(\"abcdATdomain.com\", \"AT\", \"@\") => \" [email protected] \"\nReplace([\"string1\", \"string2\", \"string3\"], \"\\d\", CONCAT(\"This\", \" was \", \" a number\")) => [\"stringThis was a number\", \"stringThis was a number\", \"stringThis was a number\"]\n\n OrElse\n\n OrElse(expression: <expression>, ...<expression>)\n\n This outputs the first non None result of the given expressions, or None if they are all None\n\n OrElse({{not.a.value}}, \" [email protected] \") => \" [email protected] \"\nOrElse([[no.values]], \"value\") => [\"value\"]\nOrElse([[no.values]], {{not.a.value}}) => None\n\n String functions\n\nThe following functions output a string or None.\n\n Match\n\n Match(expression: <simpleExpression>, regex: <literal>)\n\n This outputs the expression if it matches the regex, otherwise None\n\n Match(\"abcd\", \"[a-z]+\") => \"abcd\"\nMatch(\"abcd\", \"\\d+\") => None\n\n Get\n\n Get(expression: <multiExpression>, index: <number>)\n\n This outputs the string at index index in the expression list, and None if the index does not exist. The index can be negative to get from the end of the list.\n\n Get([\"string1\", \"string2\", \"string3\", \"string4\"], -2) => \"string3\"\nGet([\"string1\", \"string2\"], 3) => None\n\n First\n\n First(expression: <multiExpression>)\n\n This outputs the first string of the expression list, and None if it does not exist. The index can be negative to get from the end of the list.\n\n First([\"string1\", \"string2\", \"string3\", \"string4\"]) => \"string1\"\nFirst([[no.values]]) => None\n\n Last\n\n Last(expression: <multiExpression>)\n\n This outputs the last string of the expression list, and None if it does not exist. The index can be negative to get from the end of the list.\n\n Last([\"string1\", \"string2\", \"string3\", \"string4\"]) => \"string4\"\nLast([[no.values]]) => None\n\n List of string functions\n\nThe following functions output a list of string or None.\n\n Filter\n\n Filter(expression: <multiExpression>, regex: <literal>)\n\n This outputs a list of string from expression that matches the regex , None if none matches\n\n Filter([\"string1\", \"string2\", \"match\"], \"[a-z]+\") => [\"match\"]\nFilter([\"string1\", \"string2\"], \"[a-z]+\") => None\n\n Slice\n\n Slice(expression: <multiExpression>, start: <number>)\n\n This outputs the slice of the expression list between start index and its end, or None if the slice is invalid. The index can be negative to get from the end of the list.\n\n Slice([\"string1\", \"string2\", \"string3\", \"string4\"], -2) => [\"string3\", \"string4\"]\nSlice([\"string1\", \"string2\"], 3) => None\n\n Slice\n\n Slice(expression: <multiExpression>, start: <number>, end: <number>)\n\n This outputs the slice of the expression list between start and end index, or None if the slice is invalid. The index can be negative to get from the end of the list.\n\n Slice([\"string1\", \"string2\", \"string3\", \"string4\"], 1, 3) => [\"string1\", \"string2\", \"string3\"]\nSlice([\"string1\", \"string2\"], 3) => None\n\n Dictionaries\n Reports", - "keywords": [ - "computation", - "rule", - "admin-guide", - "admin-guide/other/template_string", - "horizon", - "admin", - "guide", - "common", - "configuration", - "elements" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:parameters", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Overridable configuration parameters", - "section": "admin-guide", - "slug": "admin-guide/parameters", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/parameters.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/parameters.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Overridable configuration parameters" - ], - "summary": "Overridable configuration parameters This page presents the overridable parameters from the Horizon configuration. Overriding the parameters To override one of these parameters, simply: 1. Access the EverTrust Horizon server through SSH wit", - "content": "Overridable configuration parameters\n\n This page presents the overridable parameters from the Horizon configuration.\n\n Overriding the parameters\n\n To override one of these parameters, simply:\n\n 1. Access the EverTrust Horizon server through SSH with an account with administrative privileges;\n\n 2. With an editor like vi, open the /etc/default/horizon file and go at the bottom of it;\n\n 3. Add this line at the end of the file:\n\n JAVA_OPTS=\"$JAVA_OPTS -D<option name>=<option value>\n\n As an example, if you want to modify the file extension that DER certificates will have when sent as email attachments and set it to CRT, you need to add:\n\n JAVA_OPTS=\"$JAVA_OPTS -Dhorizon.notification.mail.attachment.extension.der=\"crt\"\n\n 4. Save your modifications and restart the Horizon service:\n\n $ systemctl restart horizon\n\nOne added line means one modified option, you need to add as many lines at the end of the file as there are values that you want to override.\n\n You’ll find below an exhaustive list of overridable parameters.\n\n Parameters\n\n ACME parameters\n\n Parameter\n Default value\n Description\n\n horizon.acme.max.timeout\n\n \"5 minutes\"\n\n Maximum configurable timeout in the ACME profiles\n\n horizon.acme.max.retry.delay\n\n \"1 hour\"\n\n Maximum configurable delay in the ACME profiles\n\n horizon.acme.max.retry.count\n\n 15\n\n Maximum configurable retry count in the ACME profiles\n\n horizon.acme.order.updater.prefix\n\n \"Actor OrderUpdater#\"\n\n Name of the ACME order updater in the technical logs\n\n horizon.acme.response.verifier.prefix\n\n \"Actor ResponseVerifier#\"\n\n Name of the ACME response verifier in the technical logs\n\n horizon.acme.response.verifier.worker\n\n 5\n\n Number of instances that will be started for each Horizon node to perform the ACME validation\n\n horizon.acme.order.updater.worker\n\n 5\n\n Number of instances that will be started for each Horizon node to perform the ACME validation\n\n horizon.acme.authorization.methods\n\n [\"http-01\", \"dns-01\", \"tls-alpn-01\"]\n\n Allowed methods that can be used to complete an ACME challenge\n\n horizon.acme.order.ttl\n\n \"1 minute\"\n\n TTL of an ACME order\n\n horizon.acme.challenge.entropy\n\n 32\n\n Size of the ACME authorization value (challenge size)\n\n horizon.acme.http.json.prettify\n\n true\n\n Whether the ACME responses should be JSON-pretty formatted\n\n horizon.acme.behavior.emulate.boulder\n\n true\n\n Defines whether Horizon should behave like the Boulder ACME implementation (if set to false, Horizon will strictly follow the RFC). Only applicable if horizon.acme.http.json.prettify is set to \"true\".\n\n horizon.acme.url.scheme\n\n https\n\n Protocol to use to calculate the ACME base URL if there isn’t any X-Forwarded-Proto nor X-Forwarded-Host in the header of the request\n\n horizon.acme.url.prefix\n\n \"/acme\"\n\n Prefix used to calculate the ACME base URL\n\n horizon.acme.behavior.enable.post-as-get.legacy\n\n true\n\n Whether the ACME API can be used with GET requests instead of POST ones\n\n Bootstrap parameters\n\n Parameter\n Default value\n Description\n\n horizon.bootstrap.timeout\n\n \"1 minute\"\n\n Duration after which the bootstrap of Horizon times out\n\n horizon.bootstrap.administrator.name\n\n \"administrator\"\n\n Default administrator account name\n\n horizon.bootstrap.administrator.display.name\n\n \"Horizon Administrator\"\n\n Default administrator account display name\n\n horizon.bootstrap.local.identity.provider\n\n \"local\"\n\n Default administrator account identity provider to use\n\n horizon.bootstrap.administrator.password.path\n\n \"var/run/adminPassword\"\n\n Relative path of the file where the initial admin password should be stored into (starting at /opt/horizon/)\n\n horizon.bootstrap.administrator.password.length\n\n 24\n\n Length (in bytes) of the initial admin password\n\n Certificate Authorities parameters\n\n Parameter\n Default value\n Description\n\n horizon.ca.manager.cache.default.timeToIdle\n\n \"30 days\"\n\n Duration that the CA is kept in the CA manager’s cache without being used, after which it is removed\n\n horizon.crl.updater.parallelism\n\n 5\n\n Number of certificates processed in parallel when Horizon synchronizes its database with the CRL\n\n Default PKI queue parameters\n\n Parameter\n Default value\n Description\n\n horizon.pki.manager.default.parallelism\n\n 5\n\n Number of parallel certificate requests (enrollment, revocation…​) on the default queue\n\n horizon.pki.manager.default.size\n\n 100\n\n Number of certificate requests (enrollment, revocation) that can be queued on the default queue\n\n Events parameters\n\n Parameter\n Default value\n Description\n\n horizon.discovery.event.ttl\n\n (No default value)\n\n Time to live of the discovery events. If not set, events never expire\n\n horizon.event.chainsign\n\n true\n\n Specify whether to chain and sign the Horizon events to ensure they haven’t been tampered with\n\n horizon.event.seal.algorithm\n\n \"HS_512\"\n\n Algorithm to use to hash the signature of the events in Horizon (other possible values are \"HS_384\" and \"HS_256\")\n\n HTTP parameters\n\n Parameter\n Default value\n Description\n\n horizon.http.header.enforce_connection_close\n\n true\n\n Defines whether HTTP connections should remain open\n\n horizon.http.header.realip\n\n \"X-Real-IP\"\n\n Name of the HTTP header to use as Real IP\n\n play.http.session.maxAge\n\n Duration after which the authentication session expires\n\n \"15 minutes\"\n\n horizon.security.http.headers.xapi.key\n\n \"X-API-KEY\"\n\n Name of the HTTP header to use as XAPI-KEY\n\n horizon.security.http.headers.xapi.id\n\n \"X-API-ID\"\n\n Name of the HTTP header to use as XAPI-ID\n\n horizon.security.http.headers.xapi.idprov\n\n \"X-API-IDPROV\"\n\n Header used to store the identity provider that will be used to validate the authentication\n\n EMail notifications parameters\n\n Parameter\n Default value\n Description\n\n horizon.notification.mail.attachment.extension.der\n\n \"der\"\n\n File extension that DER certificates sent as email attachments (through the notifications feature) will be given\n\n horizon.notification.mail.attachment.extension.p7b\n\n \"p7b\"\n\n File extension that PKCS#7 certificates sent as email attachments (through the notifications feature) will be given\n\n horizon.notification.mail.attachment.extension.pem\n\n \"pem\"\n\n File extension that PEM certificates sent as email attachments (through the notifications feature) will be given\n\n Nonce parameters\n\n Parameter\n Default value\n Description\n\n horizon.[nonce type].nonce.ttl\n\n \"5 seconds\"\n\n Duration for which a nonce stays in Horizon before being removed ([nonce type] can be replaced by either automation, acme, openid or request)\n\n horizon.[nonce type].nonce.size\n\n 32\n\n Size (in bytes) of the challenge stored in the nonce ([nonce type] can be replaced by either automation, acme, openid or request)\n\n horizon.security.[nonce type]_certificate_pop.iat.future\n\n \"5 seconds\"\n\n Difference of time allowed between the \"Issued At Time\" and the validation time (or the server time) (in the future only) ([nonce type] can be replaced by either automation or request)\n\n horizon.security.[nonce type]_certificate_pop.iat.past\n\n \"5 seconds\"\n\n Difference of time allowed between the \"Issued At Time\" and the validation time (or the server time) (in the past only) ([nonce type] can be replaced by either automation or request)\n\n horizon.security.[nonce type]_certificate_pop.iat.clock_skew\n\n \"30 seconds\"\n\n Difference of time allowed between the client time and the server time ([nonce type] can be replaced by either automation or request)\n\n horizon.security.identity.provider.openid.nonce.size\n\n 32\n\n Size of the nonce value used for the OpenID authentication\n\n horizon.security.identity.provider.openid.nonce.ttl\n\n \"60 seconds\"\n\n \"Time to live\" of the OpenID authentication nonce\n\n horizon.automation.nonce.size\n\n 32\n\n Size of the nonce value used for the JWT authentication token\n\n horizon.automation.nonce.ttl\n\n \"5 seconds\"\n\n Time to live of the nonce used to validate the JWT authentication token\n\n Password reset parameters\n\n Parameter\n Default value\n Description\n\n horizon.security.local.identity.password.reset.duration\n\n \"120 second\"\n\n Time to live of a password reset request (from the login prompt)\n\n Requests/Automation parameters\n\n Parameter\n Default value\n Description\n\n horizon.request.grace_period.[module].[request workflow]\n\n \"30 days\"\n\n Time to live of an expired or completed request. Module can be est, scep or webra and the request workflow can be enroll, revoke, update, recover, migrate or renew.\n\n horizon.request.default_duration.[module].[request workflow]\n\n \"7 days\"\n\n Duration that a request can stay in either pending or approved state before expiring. Module can be est, scep or webra and the request workflow can be enroll, revoke, update, recover, migrate or renew.\n\n horizon.automation.policy.default.keyType\n\n \"rsa-2048\"\n\n Default key type sent to the automation client on ACME, EST and SCEP\n\n Search parameters\n\n Parameter\n Default value\n Description\n\n horizon.certificate.search.csv.delimiter\n\n ';'\n\n The CSV delimiter to use when exporting an HCQL query result to a CSV file\n\n horizon.certificate.search.item.separator\n\n '\\n'\n\n The CSV item separator to use when exporting an HCQL query result to a CSV file\n\n horizon.certificate.search.item.attribute.separator\n\n ':'\n\n The CSV item attribute separator to use when exporting an HCQL query result to a CSV file\n\n horizon.security.principal.search.page.default_size\n\n 50\n\n How many elements to retrieve in a security principals search query if no pageSize has been specified\n\n horizon.security.principal.search.page.max_size\n\n (No default value)\n\n How big can the pageSize parameter be in a security principals search query (Must be a positive integer)\n\n horizon.discovery.event.search.page.default_size\n\n 50\n\n How many elements to retrieve in a discovery events search query if no pageSize has been specified\n\n horizon.discovery.event.search.page.max_size\n\n (No default value)\n\n How big can the pageSize parameter be in a discovery events search query (Must be a positive integer)\n\n horizon.discovery.event.search.csv.delimiter\n\n ';'\n\n The CSV delimiter to use when exporting a discovery events query result to a CSV file\n\n horizon.request.search.page.default_size\n\n 50\n\n How many elements to retrieve in a request search query if no pageSize has been specified\n\n horizon.request.search.page.max_size\n\n (No default value)\n\n How big can the pageSize parameter be in a request search query (Must be a positive integer)\n\n horizon.request.search.csv.delimiter\n\n ';'\n\n The CSV delimiter to use when exporting an HRQL query result to a CSV file\n\n horizon.event.search.page.default_size\n\n 50\n\n How many elements to retrieve in an event search query if no pageSize has been specified\n\n horizon.event.search.page.max_size\n\n (No default value)\n\n How big can the pageSize parameter be in an event search query (Must be a positive integer)\n\n Trigger parameters\n\n Parameter\n Default value\n Description\n\n horizon.trigger.retry.initial_delay\n\n \"5 minutes\"\n\n How long must a trigger that fails for the first time wait before retrying\n\n horizon.trigger.max.retry\n\n 15\n\n Maximum amount of failed attempts that a trigger can have before canceling\n\n Internal Horizon parameters\n\nThese parameters are used internally in Horizon. Please be very careful when overriding them as it may prevent the product from working correctly.\n\n Parameter\n Default value\n Description\n\n horizon.security.trustmanager.enforce_serverauth\n\n false\n\n If set to true, enforces the use of the serverAuth EKU in the server authentication certificates (when Horizon accesses a service through TLS)\n\n horizon.ca.maximum.timeout\n\n \"5 minutes\"\n\n Maximum configurable timeout duration on certificate authorities\n\n horizon.ca.maximum.refresh\n\n \"7 days\"\n\n Maximum configurable CRL refresh period on certificate authorities\n\n horizon.pki-connector.max.timeout\n\n \"5 minutes\"\n\n Maximum configurable timeout on the PKI connectors\n\n horizon.trigger.manager.interval\n\n \"5 minutes\"\n\n How often does the trigger manager check for triggers to run\n\n horizon.trigger.manager.timeout\n\n \"60 seconds\"\n\n Trigger manager timeout\n\n horizon.grading.manager.timeout\n\n \"5 seconds\"\n\n Duration after which the grading manager times out when retrieving the grading configuration from the database\n\n horizon.grading.manager.queue.size\n\n 100\n\n How large can the grading manager queue can get before it discards new grading requests\n\n horizon.grading.timeout\n\n \"5 seconds\"\n\n Duration after which the grading actor times out when grading a certificate (upon enrolment)\n\n horizon.security.manager.timeout\n\n \"1 minute\"\n\n Duration after which the security manager times out when trying to authenticate a principal with its session\n\n horizon.ca.manager.timeout\n\n \"1 minute\"\n\n Duration that the CA manager actor will wait to retrieve information about certificates (is it trusted ? its trust chain ?)\n\n horizon.ca.manager.prefix\n\n \"Actor \"\n\n Name of the CA manager actor in the technical logs\n\n horizon.security.manager.prefix\n\n \"Actor \"\n\n Name of the security manager actor in the technical logs\n\n horizon.grading.actor.prefix\n\n \"Actor \"\n\n Name of the grading actor in the technical logs\n\n horizon.grading.manager.prefix\n\n \"Actor \"\n\n Name of the grading manager actor in the technical logs\n\n horizon.crl.updater.prefix\n\n \"Actor CRLUpdater-\"\n\n Name of the CRL updater actor in the technical logs\n\n horizon.scheduler.manager.timeout\n\n \"60 seconds\"\n\n Duration after which the Scheduler manager actor times out when retrieving scheduled tasks in the database\n\n horizon.scheduler.manager.prefix\n\n \"Actor \"\n\n Name of the Scheduler manager actor in the technical logs\n\n horizon.event.timeout\n\n \"30 seconds\"\n\n Duration after which the event manager times out when trying to retrieve the last signed event in the database\n\n horizon.event.manager.prefix\n\n \"Actor \"\n\n Name of the Event manager actor in the technical logs\n\n horizon.event.manager.interval\n\n \"5 seconds\"\n\n How often will the Event Manager actor check in the database if new a new event appeared to sign it and display it in the \"Events\" section of Horizon\n\n horizon.vault.manager.timeout\n\n \"1 minute\"\n\n Duration after which the Vault Manager times out when trying to encipher or decipher a configuration or certificate secret\n\n horizon.pki.manager.timeout\n\n \"1 minute\"\n\n Duration after which the PKI Manager times out when trying to enroll or revoke a certificate\n\n Reports\n Logging", - "keywords": [ - "overridable", - "configuration", - "parameters", - "admin-guide", - "admin-guide/parameters", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:pki_admin", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "PKI Connectors", - "section": "admin-guide", - "slug": "admin-guide/pki_admin", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/pki_admin.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/pki_admin.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "PKIs", - "PKI Connectors", - "General Information" - ], - "summary": "PKI Connectors Description A \"PKI Connector\" is a configuration piece that allows to establish the communication with any supported PKI. Additionally, it enables to map a specific certificate profile within the connected PKI. Common prerequ", - "content": "PKI Connectors\n\n Description\n\n A \"PKI Connector\" is a configuration piece that allows to establish the communication with any supported PKI. Additionally, it enables to map a specific certificate profile within the connected PKI.\n\n Common prerequisites\n\n To grant \"Horizon\" proper access to a given PKI, three categories of requirements must be gathered:\n\n Credentials : It could be either certificates (PKCS#12 format) or technical accounts (login/password) allowing to authenticate against the PKI API.\n\n Permissions : The credentials must be granted with the proper permissions on the PKI in order to be able to manage certificate lifecycle (enroll, revoke, renew).\n\n Profile/Certificate information : This information is used to map certificate types and/or certificate fields.\n\n PKI Queue\n AWS", - "keywords": [ - "pki", - "connectors", - "admin-guide", - "admin-guide/pki_admin", - "horizon", - "admin", - "guide", - "pkis", - "general", - "information" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:pki_queue", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "PKI Queue", - "section": "admin-guide", - "slug": "admin-guide/pki_queue", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/pki_queue.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/pki_queue.html", - "breadcrumbs": ["Horizon", "Admin guide", "PKIs", "PKI Queue"], - "summary": "PKI Queue This section details how to configure a PKI Queue. PKI Queue are used to limit the PKI requests (enrollment, revocation) PKI Queue Configuration 1. Log in to Horizon Administration Interface. 2. Access PKI Queues from the drawer o", - "content": "PKI Queue\n\n This section details how to configure a PKI Queue. PKI Queue are used to limit the PKI requests (enrollment, revocation)\n\n PKI Queue Configuration\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access PKI Queues from the drawer or card: PKI   PKI Queues .\n\n 3. Click on .\n\n 4. Fill in the fields:\n\n Name * (string input) :\n\nChoose a meaningful queue name. It must be unique.\n\n Description (string input) :\n\nThe description for the PKI Queue.\n\n Throttle Parallelism (int input) :\n\nNumber of requests processed at the same time.\n\n Throttle Duration ( finite duration ) :\n\nMaximum requests processed at the same time in a given duration. Parallelism must be set.\n\n Max Size * (int input) :\n\nMaximum requests stored in the queue\n\n Cluster Wide (boolean) :\n\nIf not enabled, then the throttleParallelism and throttleDuration will be the same for all nodes in the cluster.\nIf enabled, then the throttleParallelism and throttleDuration is generalized for all clusters.\n\n If the queue is full every new request will be discarded.\n\n Certification Authorities\n General Information", - "keywords": [ - "pki", - "queue", - "admin-guide", - "admin-guide/pki_queue", - "horizon", - "admin", - "guide", - "pkis" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:acme:acme", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "ACME Introduction", - "section": "admin-guide", - "slug": "admin-guide/protocols/acme/acme", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/acme/acme.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/acme/acme.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "ACME", - "ACME Introduction" - ], - "summary": "ACME Introduction This section details how to configure and consume the ACME protocol. Horizon implements an ACME service respecting the RFC 8555 and more specifically the following lifecycle workflows: Enrollment; Renewal (which is equival", - "content": "ACME Introduction\n\n This section details how to configure and consume the ACME protocol.\n\n Horizon implements an ACME service respecting the RFC 8555 and more specifically the following lifecycle workflows:\n\n Enrollment;\n\n Renewal (which is equivalent to an enrollment);\n\n Revocation.\n\n Managing certificate lifecycle through the ACME protocol involves up to three components:\n\n Horizon as the ACME endpoint;\n\n An asset executing an ACME client or directly integrating the ACME protocol;\n\n When the ACME validation method is ' dns-01 ', DNS server(s).\n\nACME validation modes will be detailed later on.\n\n The protocol paradigm can be described as follows: ' if the asset can prove it has authority on the DNS names (called identifiers in ACME) it is requesting for, the certificate should be automatically enrolled / renewed ', which is basically equivalent to a Domain Validation .\n\n The following schema is a simplified workflow of an ACME enrollment:\n\nThe protocol is based on the notion of challenge and offers three validation modes to actually verify challenges and prove that the asset owns authority on the requested DNS name(s), i.e. ACME identifiers:\n\n http-01 : For each requested identifier, Horizon will validate the challenge by connecting back in HTTP on the configured http-01 validation port (TCP/80 by default) and retrieve the response to the challenge;\n\n tls-alpn-01 : For each requested identifier, Horizon will validate the challenge by connecting back in HTTPS on the configured tls-alpn-01 validation port (TCP/443 by default) and extract the response to the challenge from an ALPN extension in the asset / client HTTPS response;\n\n dns-01 : For each requested identifier, Horizon will validate the challenge through a DNS request and look for a specific TXT entry containing the response corresponding to the challenge for the considered identifier.\n\n Therefore, validation modes have the following constraints:\n\n http-01 and tls-alpn-01 :\n\n Horizon must be able to access the asset on the validation port;\n\n The validation port must be available and opened on the asset;\n\n dns-01 : the ACME client must be configured with DNS credentials owning the permission to create TXT records on the requested domain(s).\n\nFor http-01 and tls_alpn-01 validation modes, it is possible to configure an HTTP proxy to proxify the ACME validation tentative(s). Using an HTTP proxy is useful when http-01 and/or tls-alpn-01 validation need to be performed on asset(s) hosted within a DMZ where incoming network streams must be limited. In this scenario, an HTTP proxy is configured to relay ACME validations coming from the Horizon nodes within the DMZ and a unique incoming stream needs to be open to allow communication from Horizon node to the HTTP proxy.\n\n The choice of the validation mode to use mainly depends on the architecture. Here are the EverTrust recommendations:\n\n If the requester is not the asset, prefer the dns-01 validation mode;\n\n If the requester is the asset:\n\n If the asset is reachable from Horizon nodes, prefer the http-01 ;\n\n If the asset is not reachable from Horizon nodes, prefer the dns-01 ;\n\n tls-alpn-01 is the most complicated validation mode to implement and therefore should only be used when no other validation mode is an option.\n\n Qualified ACME clients\n\n EverTrust qualifies the following ACME clients for any release of the Horizon product:\n\n Linux ACME clients:\n\n acme.sh\n\n certbot\n\n lego\n\n Horizon CLI\n\n Windows ACME client:\n\n lego\n\n WinCertes : this open source client is developed and maintained by EverTrust, therefore officially supported\n\n Horizon CLI\n\n Kubernetes: cert-manager\n\nIf an ACME client is not listed above, it does not necessarily mean that the client will not work with Horizon, only that the client is not included in the list of clients tested in Horizon’s continuous integration test cases.\n\n Automation Policy\n ACME Profile", - "keywords": [ - "acme", - "introduction", - "admin-guide", - "admin-guide/protocols/acme/acme", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:acme:acme_profile", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "ACME Profile", - "section": "admin-guide", - "slug": "admin-guide/protocols/acme/acme_profile", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/acme/acme_profile.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/acme/acme_profile.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "ACME", - "ACME Profile" - ], - "summary": "ACME Profile This section details how to configure an ACME Profile. Prerequisites PKI Connector How to configure ACME Profile 1. Log in to Horizon Administration Interface. 2. Access ACME Profile from the drawer or card: Protocols ACME . 3.", - "content": "ACME Profile\n\n This section details how to configure an ACME Profile.\n\n Prerequisites\n\n PKI Connector\n\n How to configure ACME Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access ACME Profile from the drawer or card: Protocols   ACME .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n ACME Profile Specific Configuration\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of a URL, it is advisable to use only lower case letters and dashes.\n\n Enable * (boolean) :\n\nIndicates whether the profile is enabled or not. The default value is set to true.\n\n PKI Connector (string select) :\n\nSelect a PKI connector previously created.\n\n Validations\n\n Validation Methods (select) :\n\nSelect the authorized ACME validation method(s) on the considered profile ( HTTP-01 and/or TLS-ALPN-01 and/or DNS-01 ).\n\n HTTP_01 validation port (int) :\n\nHTTP port to perform the http-01 validation (only if HTTP-01 has been selected). The default value is set to 80.\n\n TLS-ALPN_01 validation port (int) :\n\nHTTPS port to perform the tls-alpn-01 validation (only if TLS-ALPN-01 has been selected). The default value is set to 443.\n\n Challenge verification attempts * (int) :\n\nSpecify the number of times Horizon should try to validate an ACME challenge. The default value is set to 3.\n\n Challenge verification retry delay * ( finite duration ) :\n\nSpecify the time duration Horizon should wait between two consecutive validations for the same challenge. The default value is set to 3 seconds.\n\n Proxy (string select) :\n\nSpecify an HTTP proxy to use when performing http-01 or tls-alpn-01 validations.\n\n Timeout * ( finite duration ) :\n\nSpecify the time duration Horizon should wait when performing http-01 , tls-alpn-01 or dns-01 validations.\n\n Max Certificate per Holder Policy\n\n Maximum (int) :\n\nWhen specified, define the maximum number of active certificates for a given holder.\n\n Behavior (select) :\n\nWhat behavior to have when the maximum number is reached:\n\n revoke the previous certificates.\n\n reject the current request.\n\n Revocation reason (select) :\n\nWhen the revoke behavior is selected, the revocation reason to revoke the certificate with.\n\n Requests management\n\n Authorized short name (boolean) :\n\nSpecify if using short name is authorized when requesting certificate. If set to yes, one verifiable FQDN must be requested for each specified short name. The default value is set to false.\n\n Authorized empty contact (boolean) :\n\nSpecify if an ACME account can be registered without specifying a contact email address. Default to false.\n\n Default contacts email (string input multiple) :\n\nSpecify a list of default contact email addresses when registering an ACME account with no specified contact email address.\n\n Max DNS name (int) :\n\nIf specified, enforce the maximum number of requested DNS name(s).\n\n Meta\n\n Is required terms of service (boolean) :\n\nSpecify if explicitly agreeing to the terms of service is required when registering an ACME account. The default value is set to false.\n\n Terms of service (string input) :\n\nSpecify an URL identifying the current terms of service.\n\n Website (string input) :\n\nSpecify an HTTP or HTTPS URL locating a website providing more information about the ACME server.\n\n CAA Identities (string input) :\n\nThe hostnames that the ACME server recognizes as referring to itself for the purposes of CAA record validation as defined in RFC6844 .\n\n Crypto policy\n\n Default Key Type (select) :\n\nKey Type that will be used by horizon-cli in certificate enrollment.\n\n Authorized Key Types (multiselect) :\n\nKey Types that can be used for enrollment. An empty value means no restrictions.\n\n Common configuration for profiles\n\n Languages\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of this profile.\n\n Description (string input) :\n\nEnter a description. This will be displayed on the list view of the profiles.\n\n You can delete the localization.\n\n Grading Policies\n\n You can select grading policies that will grade your certificate for a quick overview of its quality.\nFor more information about the inner working of the grading policies in Horizon, please refer to the grading rules page .\n\n Workflows builder\n\n Configure custom rights for actions on this profile.\n\n 1. Select an authorization level for each workflow.\n\n Everyone :\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live\n\n Configure the time your requests have before expiring.\n\nAfter expiration, requests are stored for an additional 30 days. This can be changed using configuration files .\n\n Enrollment request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Renewal request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Revocation request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Update request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Migration request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Recover request ( finite duration ) :\n\n Enabled on escrow : Must be a valid finite duration. The default value is set to seven days.\n\n Self Permissions\n\n These permissions apply to the owners of a certificate (team or owner). An owner can always request the following actions, but this permission allows them to perform the action without validation.\n\n Revoke (boolean) :\n\nGrant self revoke permission. The default value is set to false.\n\n Revoke (pop) (boolean) :\n\nGrant self revoke permission with owner being determined by Proof of Possession. This is used by horizon-cli. The default value is set to false.\n\n Update (boolean) :\n\nGrant self update permission. The default value is set to false.\n\n Update (pop) (boolean) :\n\nGrant self update permission with owner being determined by Proof of Possession. This is used by horizon-cli. The default value is set to false.\n\n Constraints\n\n Allowed email domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\nThis matches the domain of the email, not including anything before @ .\n\n Allowed DNS domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n CSR Data Mapping\n\n 1. Click on to add a mapping.\n\n 2. Select a field and enter a value.\n\n You can delete the CSR Data Mapping.\n\n Certificate Template\n\n This section details how to define a custom structure for the fields subject DN , SAN & extensions of the requested certificate in order to match the configuration on the PKI side.\n\nDefining a template will use the CSR to fill the available field. A CSR with unexpected fields will be rejected. Using a template also disables CSR Data Mapping.\n\n Subject DN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Subject DN template.\n\nWhen a template is defined, at least one mandatory Common Name must be added to the DN Elements.\n\n SAN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the element list.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Minimum (int) :\n\nThe minimum number of value that this SAN must have.\n\n Maximum (int) :\n\nThe maximum number of value that this SAN must have.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the SAN template.\n\n Extensions\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Extensions template.\n\nWhen adding a SAN, a DN element or an Extension and making it mandatory, make sure to either give it a default value or a computation rule or make it editable, otherwise the template will be unusable.\n\n Certificate Metadata\n\n This section details how to define a custom structure for the labels, ownership policy and technical metadata, allowing certificates to hold rich information.\n\n Labels\n\n You can add more labels by clicking .\n\n Name (select) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nShould the label be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Open the popup, enter the label value and press \"enter\" to add this value to the accepted value list. An empty whitelist means no restriction.\n\n Suggestions (string input multiple) :\n\nAdd suggestions that will be displayed to the user. The user will be able to choose one of these values or enter its own. Open the popup, enter your suggestions and press enter to add this value to the suggestions. An empty suggestions list means no restriction.\n\n Regex ( regex ) :\n\nThe label value will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this label to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can delete or reorder (drag and drop) the label template.\n\n Ownership policy\n\n Owner\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s owner is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the owner to the value of the evaluated computation rule . This value will override any other value including the user input.\n\n Contact email\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s contact email is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when approving a request.\n\n Default contact email (string input) :\n\nSet a default contact email. This value must comply with the contact email restriction.\n\n Contact email restriction\n\n Whitelist (string input multiple) :\n\nThe contact email will have to be in the whitelist. Open the popup, enter the email and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe contact email will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the contact email to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Team\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s team is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe team will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the team to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Metadata policy (overridable metadata)\n\nThese metadata are technical metadata. They are used by Horizon or Third party connectors, updating them should be done with utmost care.\n\nMetadata edition is not allowed on enroll.\n\nMetadata edition is not available via the User Interface. It must be changed with API, using horizon-cli.\n\n You can allow the override of technical metadata by clicking .\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n You can delete a metadata policy. This will not delete the metadata but will make it non editable.\n\n Notifications\n\n This section details how to configure notifications on certificate and request lifecycle events.\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n Renew\n\n Select a preexisting email or groupware notification to associate it with an event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by an Enroll/Revocation/Update/Migrate/Renew request:\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n Select a preexisting email or groupware notification to associate it with an event.\n\nSubmit request events are not triggered when the user has the permission to perform the action directly.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the ACME Profile.\n\n You won’t be able to delete an ACME Profile if it is referenced somewhere else.\n\n ACME Introduction\n ACME client usages", - "keywords": [ - "acme", - "profile", - "admin-guide", - "admin-guide/protocols/acme/acme_profile", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:acme:acme_usage", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "ACME client usages", - "section": "admin-guide", - "slug": "admin-guide/protocols/acme/acme_usage", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/acme/acme_usage.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/acme/acme_usage.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "ACME", - "ACME client usages" - ], - "summary": "ACME client usages This section details how to use the most common Linux and Windows ACME clients. Linux ACME clients This section details how to use the acme.sh and certbot ACME clients. Overview Certbot is able to run on any recent UNIX-l", - "content": "ACME client usages\n\n This section details how to use the most common Linux and Windows ACME clients.\n\n Linux ACME clients\n\n This section details how to use the acme.sh and certbot ACME clients.\n\n Overview\n\n Certbot is able to run on any recent UNIX-like operating system equipped with Python 2.7 or 3.4+, while acme.sh can also run on any recent Linux distribution running either bash, dash or sh.\n\n They both fully support the latest ACMEv2 protocol including its main latest feature: wildcard certificates (*.example.com).\n\n Both clients supports different modes for obtaining a certificate and in some cases automatically installing it.\n\n The following tables lists the different modes for each clients:\n\n Modes\n certbot\n acme.sh\n Notes\n\n apache\n\n Y\n\n Y\n\n Obtains and automatically installs a certificate using the running Apache server. (For acme.sh, this mode will only obtain a certificate without installing it)\n\n nginx\n\n Y\n\n Y\n\n Obtains and automatically installs a certificate using the running NGINX server. (For acme.sh, this mode will only obtain a certificate without installing it)\n\n webroot\n\n Y\n\n Y\n\n Obtains a certificate by writing to the webroot directory of an already running web server\n\n standalone\n\n Y\n\n Y\n\n Uses a \"standalone\" web server managed by Certbot or acme.sh. This mode is useful on system with no web servers or if using the running web server is not desired\n\n DNS\n\n Y\n\n Y\n\n This mode automates obtaining a certificate by modifying a DNS record to prove the control over a domain\n\n tls-alpn\n\n N\n\n Y\n\n Uses a TLS server to validate the control over a domain\n\n Requesting a certificate\n\n Both clients must be started using administrative privileges ( sudo ), except for acme.sh when using the webroot or DNS modes.\n\n Each client requires only a few parameters to request a certificate.\n\n acme.sh parameters:\n\n Parameter\n Description\n\n -issue\n\n Obtain or renew a certificate, but does not install it\n\n -w [VALUE]\n\n Path of the server’s webroot folder\n\n -d [VALUE]\n\n The domain(s) to enroll.\n\n certbot parameters:\n\n Parameter\n Description\n\n certonly\n\n Obtain or renew a certificate, but does not install it\n\n –webroot\n\n Place files in a server’s webroot folder for authentication\n\n -w [VALUE]\n\n Path of the server’s webroot folder\n\n -d [VALUE]\n\n The domain(s) to enroll.\n\n Requesting a certificate for Apache using certbot:\n\n (sudo) certbot run --apache --no-eff-email --agree-tos --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -m <contact email address, example: [email protected] > --domain <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --apache : Enables the Apache mode\n\n --no-eff-email : Does not share your email address with EFF\n\n --agree-tos : Explicitly agrees to the terms of service\n\n --server : Horizon ACME profile endpoint\n\n -m : Contact email address\n\n --domain : Requested DNS name (can be specified several times)\n\n Requesting a certificate for nginx using certbot:\n\n (sudo) certbot run --nginx --no-eff-email --agree-tos --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -m <contact email address, example: [email protected] > --domain <DNS name, example: nginx.evertrust.fr>\n\n Where:\n\n --nginx : Enables the nginx mode\n\n --no-eff-email : Does not share your email address with EFF\n\n --agree-tos : Explicitly agrees to the terms of service\n\n --server : Horizon ACME profile endpoint\n\n -m : Contact email address\n\n --domain : Requested DNS name (can be specified several times)\n\n Requesting a certificate for nginx using acme.sh:\n\n (sudo) acme.sh --issue --nginx --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> --accountemail <contact email address, example: [email protected] > -d <DNS name, example: nginx.evertrust.fr>\n\n Where:\n\n --issue : Specifies that this is a certificate request\n\n --nginx : Enables the nginx mode\n\n --server : Horizon ACME profile endpoint\n\n --accountemail : Contact email address\n\n -d : Requested DNS name (can be specified several times)\n\n Requesting a certificate in standalone mode using certbot:\n\n (sudo) certbot certonly --standalone --no-eff-email --agree-tos --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -m <contact email address, example: [email protected] > --domain <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --standalone : Enables the standalone mode, i.e. certbot will start a local web server to server the response\n\n --no-eff-email : Does not share your email address with EFF\n\n --agree-tos : Explicitly agrees to the terms of service\n\n --server : Horizon ACME profile endpoint\n\n -m : Contact email address\n\n --domain : Requested DNS name (can be specified several times)\n\n Requesting a certificate in standalone mode using acme.sh:\n\n (sudo) acme.sh --issue --standalone --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> --accountemail <contact email address, example: [email protected] > -d <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --issue : Specifies that this is a certificate request\n\n --standalone : Enables the standalone mode, i.e. acme.sh will start a local web server to server the response\n\n --server : Horizon ACME profile endpoint\n\n --accountemail : Contact email address\n\n -d : Requested DNS name (can be specified several times)\n\n Revoking a certificate\n\n Revoking a certificate using certbot:\n\n (sudo) certbot revoke --cert-path <path of the certificate to revoke> --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory>\n\n Where:\n\n --cert-path : Specifies the path of the certificate to revoke\n\n --server : Horizon ACME profile endpoint\n\n Revoking a certificate using acme.sh:\n\n (sudo) acme.sh --server <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> --revoke -d <DNS name, example: apache.evertrust.fr>\n\n Where:\n\n --server : Horizon ACME profile endpoint\n\n -d : DNS name of the certificate to revoke\n\n Windows ACME clients\n\n This section details how to use the WinCertes ACME client.\n\n Overview\n\n WinCertes is a simple and efficient CLI-based client made to run on any Windows Server ( > Windows Server 2008 R2 SP1 (64 bits)) and running .NET 4.6.1 or higher.\n\n The client fully supports ACMEv2 including its latest feature, along with the support of wildcard certificates (*.example.com).\n\n WinCertes eases certificate installation and renewal by automatically binding them to the appropriate web site on IIS and by creating a Scheduled Task that will check the expiration date of the certificates and trigger a renewal if necessary.\n\n WinCertes offers the possibility to launch a PowerShell script upon the successful retrieval of a certificate. This feature enables advanced deployment on Exchange or multi-servers for instance.\n\n The client supports two validation modes for validating the identity of the certificate requester:\n\n HTTP challenge validation\n\n With the ability to support the running IIS web server or to use an embedded standalone web server for easier configuration.\n\n DNS challenge validation\n\n Support for Windows DNS Server\n\n Support for acme-dns\n\n Requesting a certificate\n\n To request a certificate using WinCertes, the Windows command line ( cmd.exe ) must be run as Administrator.\n\n Then WinCertes requires only a few parameters to request a certificate:\n\n Parameter\n Description\n\n -d [VALUE]\n\n The domain(s) to enroll\n\n -w\n\n toggle the local web server use and sets its ROOT directory (default c:\\inetpub\\wwwroot ).\n\nActivates HTTP validation mode.\n\n -b [VALUE]\n\n The name of the IIS web site to bind the certificate to\n\n -p\n\n Used to make WinCertes create a Scheduled Task to handle certificate renewal\n\n There are many more options to customize the requests to specific needs.\n\n Requesting a certificate for IIS using WinCertes:\n\n (as administrator) wincertes -s <Horizon ACME endpoint, example: https://horizon.evertrust.fr/acme/profile1/directory> -w -b <IIS Site Name, example: \"Default Web Site\"> -p -e <contact email address, example: [email protected] > -d <DNS name, example: iis.evertrust.fr>\n\n Where:\n\n -s : Horizon ACME profile endpoint\n\n -w : Enables standalone mode, i.e. WinCertes will start a local web server to serve the response\n\n -b : IIS Web Site name\n\n -p : Registers a scheduled task to enable certificate automated renewal\n\n -e : Contact email address\n\n ACME Profile\n CRMP Introduction", - "keywords": [ - "acme", - "client", - "usages", - "admin-guide", - "admin-guide/protocols/acme/acme_usage", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:crmp:crmp", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "CRMP Introduction", - "section": "admin-guide", - "slug": "admin-guide/protocols/crmp/crmp", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/crmp/crmp.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/crmp/crmp.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "CRMP", - "CRMP Introduction" - ], - "summary": "CRMP Introduction This integration involves the following components: OpenTrust CMS EverTrust Horizon Cards to be enrolled The integration is very simple, Horizon acting as an OpenTrust PKI for OpenTrust CMS. We will first see how to config", - "content": "CRMP Introduction\n\n This integration involves the following components:\n\n OpenTrust CMS\n\n EverTrust Horizon\n\n Cards to be enrolled\n\n The integration is very simple, Horizon acting as an OpenTrust PKI for OpenTrust CMS.\nWe will first see how to configure the Horizon CRMP Profile, which will define how to enroll your certificates, and then a step by step guide for a quick integration.\n\n ACME client usages\n CRMP Profile", - "keywords": [ - "crmp", - "introduction", - "admin-guide", - "admin-guide/protocols/crmp/crmp", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:crmp:crmp_enroll", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Enroll your first card with OpenTrust CMS", - "section": "admin-guide", - "slug": "admin-guide/protocols/crmp/crmp_enroll", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/crmp/crmp_enroll.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/crmp/crmp_enroll.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "CRMP", - "Enroll your first card with OpenTrust CMS" - ], - "summary": "Enroll your first card with OpenTrust CMS A step by step guide for a perfect integration between Horizon and OpenTrust CMS Configure Horizon Create your profiles. In Configuration Protocols CRMP you will have the possibility to setup your p", - "content": "Enroll your first card with OpenTrust CMS\n\n A step by step guide for a perfect integration between Horizon and OpenTrust CMS\n\n Configure Horizon\n\n Create your profiles.\n\nIn Configuration   Protocols   CRMP you will have the possibility to setup your profiles.\n\nLet’s create three profiles, that will later result in 3 certificates for each user: an authentication certificate, a signing certificate and an encryption certificate.\n\nThe first two will be decentralized profiles, and the encryption one will be centralized with escrow, so that we can always decrypt the user communications later. All configuration options are available in the profile section.\n\n Create an account.\n\nOpenTrust CMS will need access to Horizon in order to manage your cards certificates.\n\nIn order to do so, a certificate needs to be enrolled on a CA trusted by Horizon for client authentication.\n\nThis certificate should be able to enroll , revoke , recover and search on the CRMP profiles you want it to manage.\n\nMy certificate will here have for DN: CN=horizon-auth , and I will give it the appropriate rights.\n\n Configure your CMS applications\n\n Connect your applications.\n\nFor each of the profiles on Horizon, an application must be created.\n\nIt first needs to be able to connect.\n\nThe server url must be set to https://<horizon-url>/crmp .\n\nThe SSL client identity must then be set to the certificate created in step I.2 .\n\n Map your applications.\n\nThe information setup on Horizon will be displayed, and the fields can be mapped.\n\nThe enrolled certificate on Horizon will be the result of the values mapped in the Horizon Fields on the left.\n\nIt should be noted that some Horizon fields are indexed, but the CMS does not display numbers. They are ordered in the same order as on Horizon, with mandatory fields first and then optional fields.\n\n Escrow : Due to a technical limitation in the CMS, for certificates that are escrowed, a field with technical name userprincipalname must be mapped to the selected Data Field Identifier in the CRMP Profile. Otherwise, the user will not be able to recover its certificates. The field userprincipalname must then be able to uniquely identify each user.\n\n CRMP Profile\n EST Introduction", - "keywords": [ - "enroll", - "your", - "first", - "card", - "with", - "opentrust", - "cms", - "admin-guide", - "admin-guide/protocols/crmp/crmp_enroll", - "horizon", - "admin", - "guide", - "protocols", - "crmp" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:crmp:crmp_profile", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "CRMP Profile", - "section": "admin-guide", - "slug": "admin-guide/protocols/crmp/crmp_profile", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/crmp/crmp_profile.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/crmp/crmp_profile.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "CRMP", - "CRMP Profile" - ], - "summary": "CRMP Profile This section details how to configure the CRMP Profile Prerequisites PKI Connector How to configure CRMP Profile 1. Log in to Horizon Administration Interface. 2. Access CRMP Profile from the drawer or card: Protocol CRMP . 3. ", - "content": "CRMP Profile\n\n This section details how to configure the CRMP Profile\n\n Prerequisites\n\n PKI Connector\n\n How to configure CRMP Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access CRMP Profile from the drawer or card: Protocol   CRMP .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n CRMP profile specific configuration\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon use the name to identify the profile.\n\n Enable (boolean) :\n\nTells whether the profile is enabled for enrollment or not. The default value is set to true.\n\n PKI Connector * (string select) :\n\nSelect a PKI connector previously created.\n\n Data field identifier (select) :\n\n Enabled on Escrow : When recovering a certificate, select on which Horizon field the field named userprincipalname on the CMS will be mapped. This will be used to identify a user, so this data should be a unique identifier on the CMS side, in a field named userprincipalname , and mapped to the corresponding Horizon field in application configuration on the CMS.\n\n Crypto policy\n\n Default Key Type * (select) :\n\nKey Type that will be used by the CMS in certificate enrollment.\n\n Centralized enrollment (boolean) :\n\nEnable centralized enrollment. In CRMP, only one enrollment mode can be enabled.\n\n Private key escrowing (boolean) :\n\nEnable key escrow. Only available in centralized enrollment mode.\n\n PKCS#12 Password generation Mode * (select) :\n\n For certificate recovery : Select a mode for PKCS#12 password generation:\n\n manual : prompt the user to choose its password.\n\n random : have the password generated on Horizon side.\n\n Password policy (select) :\n\nSelect a previously created password policy. It will be enforced on PKCS#12 password for recovery and CMS centralized enrollments.\n\n Store encryption type * (select) :\n\nSelect an encryption algorithm from the list. The PKCS#12 will use this algorithm. For CRMP it is enforced on DES Average because of CMS support.\n\n Decentralized enrollment (boolean) :\n\nEnable decentralized enrollment. In CRMP, only one enrollment mode can be enabled.\n\n Max Certificate per Holder Policy\n\n Maximum (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Behavior (select) :\n\nWhat behavior to have when the maximum number is reached:\n\n revoke the previous certificates.\n\n reject the current request.\n\n Revocation reason (select) :\n\nWhen the revoke behavior is selected, the revocation reason to revoke the certificate with.\n\n Common configuration for profiles\n\n Languages\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of this profile.\n\n Description (string input) :\n\nEnter a description. This will be displayed on the list view of the profiles.\n\n You can delete the localization.\n\n Grading Policies\n\n You can select grading policies that will grade your certificate for a quick overview of its quality.\nFor more information about the inner working of the grading policies in Horizon, please refer to the grading rules page .\n\n Workflows builder\n\n Configure custom rights for actions on this profile.\n\n 1. Select an authorization level for each workflow.\n\n Everyone :\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live\n\n Configure the time your requests have before expiring.\n\nAfter expiration, requests are stored for an additional 30 days. This can be changed using configuration files .\n\n Enrollment request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Renewal request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Revocation request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Update request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Migration request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Recover request ( finite duration ) :\n\n Enabled on escrow : Must be a valid finite duration. The default value is set to seven days.\n\n Self Permissions\n\n These permissions apply to the owners of a certificate (team or owner). An owner can always request the following actions, but this permission allows them to perform the action without validation.\n\n Revoke (boolean) :\n\nGrant self revoke permission. The default value is set to false.\n\n Recover (boolean) :\n\nGrant self recover permission. The default value is set to false.\n\n Update (boolean) :\n\nGrant self update permission. The default value is set to false.\n\n Constraints\n\n Allowed email domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\nThis matches the domain of the email, not including anything before @ .\n\n Allowed DNS domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n Certificate Template\n\n This section details how to define a custom structure for the fields subject DN , SAN & extensions of the requested certificate in order to match the configuration on the PKI side.\n\nIn a CRMP profile, defining a template is mandatory.\n\n Subject DN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Subject DN template.\n\nWhen a template is defined, at least one mandatory Common Name must be added to the DN Elements.\n\n SAN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the element list.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Minimum (int) :\n\nThe minimum number of value that this SAN must have.\n\n Maximum (int) :\n\nThe maximum number of value that this SAN must have.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the SAN template.\n\n Extensions\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Extensions template.\n\nWhen adding a SAN, a DN element or an Extension and making it mandatory, make sure to either give it a default value or a computation rule or make it editable, otherwise the template will be unusable.\n\n Certificate Metadata\n\n This section details how to define a custom structure for the labels, ownership policy and technical metadata, allowing certificates to hold rich information.\n\n Labels\n\n You can add more labels by clicking .\n\n Name (select) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nShould the label be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Open the popup, enter the label value and press \"enter\" to add this value to the accepted value list. An empty whitelist means no restriction.\n\n Suggestions (string input multiple) :\n\nAdd suggestions that will be displayed to the user. The user will be able to choose one of these values or enter its own. Open the popup, enter your suggestions and press enter to add this value to the suggestions. An empty suggestions list means no restriction.\n\n Regex ( regex ) :\n\nThe label value will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this label to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can delete or reorder (drag and drop) the label template.\n\n Ownership policy\n\n Owner\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s owner is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the owner to the value of the evaluated computation rule . This value will override any other value including the user input.\n\n Contact email\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s contact email is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when approving a request.\n\n Default contact email (string input) :\n\nSet a default contact email. This value must comply with the contact email restriction.\n\n Contact email restriction\n\n Whitelist (string input multiple) :\n\nThe contact email will have to be in the whitelist. Open the popup, enter the email and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe contact email will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the contact email to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Team\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s team is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe team will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the team to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Metadata policy (overridable metadata)\n\nThese metadata are technical metadata. They are used by Horizon or Third party connectors, updating them should be done with utmost care.\n\nMetadata edition is not allowed on enroll.\n\nMetadata edition is not available via the User Interface. It must be changed with API, using horizon-cli.\n\n You can allow the override of technical metadata by clicking .\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n You can delete a metadata policy. This will not delete the metadata but will make it non editable.\n\n Notifications/Triggers\n\n This section details how to configure notifications and triggers to perform actions on certificate and request lifecycle events.\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n Renew\n\n Select a preexisting email or groupware notification to associate it with an event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by an Enroll/Revocation/Update/Migrate/Renew request:\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n Select a preexisting email or groupware notification to associate it with an event.\n\nSubmit request events are not triggered when the user has the permission to perform the action directly.\n\n Triggers\n\n Horizon support the use of third-party triggers in the form of callbacks on specific events happening on the profile, giving a way to synchronize the third party repositories and Horizon.\n\n Enrollment (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate is enrolled on this profile.\n\n Renewal (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate is renewed on this profile.\n\n Revocation (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate gets revoked on this profile.\n\n Expire (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate expires on this profile.\n\n The available triggers are the following:\n\n AKV Trigger\n\n AWS Trigger\n\n F5 Trigger\n\n LDAP Triggers\n\n On WebRA and Intune PKCS only: Intune PKCS Trigger\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the CRMP Profile.\n\n You won’t be able to delete a CRMP Profile if a certificate is enrolled on it.\n\n CRMP Introduction\n Enroll your first card with OpenTrust CMS", - "keywords": [ - "crmp", - "profile", - "admin-guide", - "admin-guide/protocols/crmp/crmp_profile", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:est:est", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "EST Introduction", - "section": "admin-guide", - "slug": "admin-guide/protocols/est/est", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/est/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/est/est.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "EST", - "EST Introduction" - ], - "summary": "EST Introduction This section refers to the EST protocol, as described by RFC 7030 . Enroll your first card with OpenTrust CMS EST Profile", - "content": "EST Introduction\n\n This section refers to the EST protocol, as described by RFC 7030 .\n\n Enroll your first card with OpenTrust CMS\n EST Profile", - "keywords": [ - "est", - "introduction", - "admin-guide", - "admin-guide/protocols/est/est", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:est:est_profile", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "EST Profile", - "section": "admin-guide", - "slug": "admin-guide/protocols/est/est_profile", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/est/est_profile.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/est/est_profile.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "EST", - "EST Profile" - ], - "summary": "EST Profile This section details how to configure the EST Profile Prerequisites PKI Connector How to configure EST Profile 1. Log in to Horizon Administration Interface. 2. Access EST Profile from the drawer or card: Protocol EST . 3. Click", - "content": "EST Profile\n\n This section details how to configure the EST Profile\n\n Prerequisites\n\n PKI Connector\n\n How to configure EST Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access EST Profile from the drawer or card: Protocol   EST .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n EST Specific Configuration\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon use the name to identify the profile.\n\n Enable (boolean) :\n\nTells whether the profile is enabled or not.\nThe default value is set to true.\n\n PKI Connector (string select) :\n\nSelect a PKI connector previously created.\n\n Authorization and validation\n\n Authorization mode (select) :\n\nSelect from the list.\n\n Authorized :\n\n Enable whitelist (boolean) :\n\nTells whether whitelist is enabled or not. The default value is set to false.\n\n CA * (select) :\n\nSelect a Certificate Authority previously created.\n\n X509 :\n\n Enrollment CAs (select) :\n\nAvailable only if mode at x509. Select a Certificate Authority previously created.\n\n Enable whitelist (boolean) :\n\nTells whether whitelist is enabled or not. The default value is set to false.\n\n CA * (select) :\n\nSelect a Certificate Authority previously created.\n\n Challenge :\n\n Password policy (select) :\n\nSelect a password policy previously created. It is used for the challenge generation.\n\n Enable whitelist (boolean) :\n\nTells whether whitelist is enabled or not. The default value is set to false.\n\n CA * (select) :\n\nSelect a Certificate Authority previously created.\n\n Max Certificate per Holder Policy\n\n Maximum (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Behavior (select) :\n\nWhat behavior to have when the maximum number is reached:\n\n revoke the previous certificates.\n\n reject the current request.\n\n Revocation reason (select) :\n\nWhen the revoke behavior is selected, the revocation reason to revoke the certificate with.\n\n Renewal management\n\n Renewal period ( finite duration ) :\n\nMust be a valid finite duration.\n\n Renewal CAs (select) :\n\nSelect a Certificate Authority previously created.\n\n Crypto Policy\n\n Default Key Type (select) :\n\nSelect the default type of key to generate when using centralized enrollment mode.\n\n Authorized Key Types (multiselect) :\n\nKey Types that can be used for enrollment. An empty value means no restrictions.\n\n Centralized enrollment (boolean) :\n\nTells whether the profile should be used with a centralized enrollment, i.e providing a PKCS#12.\nThe default value is set to false.\n\n Private key escrowing (boolean) :\n\nTells whether the private key should be escrowed by Horizon.\nThe default value is set to false.\n\n Show PKCS#12 Password On Recover (boolean) :\n\nTells whether the PKCS#12 password should be displayed on recover.\nThe default value is set to false.\n\n Show PKCS#12 On Recover (boolean) :\n\nTells whether the PKCS#12 should be displayed on recover.\nThe default value is set to false.\n\n PKCS#12 Password Mode * (select) :\n\nSelect how to generate PKCS#12 password:\n\n manual : prompt the user to choose its password. This is the default behavior.\n\n random : have the password generated on Horizon side.\n\n Password policy (select) :\n\nSelect a previously created password policy. It will be enforced on PKCS#12 password for recovery and centralized enrollments.\n\n Store encryption type * (select) :\n\nSelect an encryption algorithm from the list. The PKCS#12 will use this algorithm.\nThe default value is set to DES_AVERAGE.\n\n Decentralized enrollment (boolean) :\n\nTells whether the profile should be used with a decentralized enrollment mode, i.e CSR (PKCS#10) signing by the PKI.\nThe default value is set to true.\n\n Common configuration for profiles\n\n Languages\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of this profile.\n\n Description (string input) :\n\nEnter a description. This will be displayed on the list view of the profiles.\n\n You can delete the localization.\n\n Grading Policies\n\n You can select grading policies that will grade your certificate for a quick overview of its quality.\nFor more information about the inner working of the grading policies in Horizon, please refer to the grading rules page .\n\n Workflows builder\n\n Configure custom rights for actions on this profile.\n\n 1. Select an authorization level for each workflow.\n\n Everyone :\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live\n\n Configure the time your requests have before expiring.\n\nAfter expiration, requests are stored for an additional 30 days. This can be changed using configuration files .\n\n Enrollment request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Renewal request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Revocation request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Update request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Migration request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Recover request ( finite duration ) :\n\n Enabled on escrow : Must be a valid finite duration. The default value is set to seven days.\n\n Self Permissions\n\n These permissions apply to the owners of a certificate (team or owner). An owner can always request the following actions, but this permission allows them to perform the action without validation.\n\n Revoke (boolean) :\n\nGrant self revoke permission. The default value is set to false.\n\n Revoke (pop) (boolean) :\n\nGrant self revoke permission with owner being determined by Proof of Possession. This is used by horizon-cli. The default value is set to false.\n\n Recover (boolean) :\n\nGrant self recover permission. The default value is set to false.\n\n Update (boolean) :\n\nGrant self update permission. The default value is set to false.\n\n Update (pop) (boolean) :\n\nGrant self update permission with owner being determined by Proof of Possession. This is used by horizon-cli. The default value is set to false.\n\n Constraints\n\n Allowed email domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\nThis matches the domain of the email, not including anything before @ .\n\n Allowed DNS domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n CSR Data Mapping\n\n 1. Click on to add a mapping.\n\n 2. Select a field and enter a value.\n\n You can delete the CSR Data Mapping.\n\n Certificate Template\n\n This section details how to define a custom structure for the fields subject DN , SAN & extensions of the requested certificate in order to match the configuration on the PKI side.\n\nDefining a template will use the CSR to fill the available field. A CSR with unexpected fields will be rejected. Using a template also disables CSR Data Mapping.\n\n Subject DN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Subject DN template.\n\nWhen a template is defined, at least one mandatory Common Name must be added to the DN Elements.\n\n SAN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the element list.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Minimum (int) :\n\nThe minimum number of value that this SAN must have.\n\n Maximum (int) :\n\nThe maximum number of value that this SAN must have.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the SAN template.\n\n Extensions\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Extensions template.\n\nWhen adding a SAN, a DN element or an Extension and making it mandatory, make sure to either give it a default value or a computation rule or make it editable, otherwise the template will be unusable.\n\n Certificate Metadata\n\n This section details how to define a custom structure for the labels, ownership policy and technical metadata, allowing certificates to hold rich information.\n\n Labels\n\n You can add more labels by clicking .\n\n Name (select) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nShould the label be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Open the popup, enter the label value and press \"enter\" to add this value to the accepted value list. An empty whitelist means no restriction.\n\n Suggestions (string input multiple) :\n\nAdd suggestions that will be displayed to the user. The user will be able to choose one of these values or enter its own. Open the popup, enter your suggestions and press enter to add this value to the suggestions. An empty suggestions list means no restriction.\n\n Regex ( regex ) :\n\nThe label value will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this label to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can delete or reorder (drag and drop) the label template.\n\n Ownership policy\n\n Owner\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s owner is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the owner to the value of the evaluated computation rule . This value will override any other value including the user input.\n\n Contact email\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s contact email is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when approving a request.\n\n Default contact email (string input) :\n\nSet a default contact email. This value must comply with the contact email restriction.\n\n Contact email restriction\n\n Whitelist (string input multiple) :\n\nThe contact email will have to be in the whitelist. Open the popup, enter the email and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe contact email will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the contact email to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Team\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s team is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe team will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the team to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Metadata policy (overridable metadata)\n\nThese metadata are technical metadata. They are used by Horizon or Third party connectors, updating them should be done with utmost care.\n\nMetadata edition is not allowed on enroll.\n\nMetadata edition is not available via the User Interface. It must be changed with API, using horizon-cli.\n\n You can allow the override of technical metadata by clicking .\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n You can delete a metadata policy. This will not delete the metadata but will make it non editable.\n\n Notifications\n\n This section details how to configure notifications on certificate and request lifecycle events.\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n Renew\n\n Select a preexisting email or groupware notification to associate it with an event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by an Enroll/Revocation/Update/Migrate/Renew request:\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n Select a preexisting email or groupware notification to associate it with an event.\n\nSubmit request events are not triggered when the user has the permission to perform the action directly.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the EST Profile.\n\n You won’t be able to delete a EST Profile if this one is referenced somewhere else.\n\n EST Introduction\n SCEP Introduction", - "keywords": [ - "est", - "profile", - "admin-guide", - "admin-guide/protocols/est/est_profile", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:scep:scep", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "SCEP Introduction", - "section": "admin-guide", - "slug": "admin-guide/protocols/scep/scep", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/scep/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/scep/scep.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "SCEP", - "SCEP Introduction" - ], - "summary": "SCEP Introduction This section refers to the SCEP protocol, as described by RFC 8894 . EST Profile SCEP Profile", - "content": "SCEP Introduction\n\n This section refers to the SCEP protocol, as described by RFC 8894 .\n\n EST Profile\n SCEP Profile", - "keywords": [ - "scep", - "introduction", - "admin-guide", - "admin-guide/protocols/scep/scep", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:scep:scep_profile", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "SCEP Profile", - "section": "admin-guide", - "slug": "admin-guide/protocols/scep/scep_profile", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/scep/scep_profile.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/scep/scep_profile.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "SCEP", - "SCEP Profile" - ], - "summary": "SCEP Profile This section details how to configure the SCEP Profile Prerequisites PKI Connector SCEP Authority How to configure SCEP Profile 1. Log in to Horizon Administration Interface. 2. Access SCEP Profile from the drawer or card: Prot", - "content": "SCEP Profile\n\n This section details how to configure the SCEP Profile\n\n Prerequisites\n\n PKI Connector\n\n SCEP Authority\n\n How to configure SCEP Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access SCEP Profile from the drawer or card: Protocol   SCEP .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n SCEP Profile Specific Configuration\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon use the name to identify the profile.\n\n Enable (boolean) :\n\nTells whether the profile is enabled or not. The default value is set to true.\n\n PKI Connector * (string select) :\n\nSelect a PKI connector previously created.\n\n Authorize POST enrollment (boolean) :\n\nEnable scep enrollment routes with HTTP POST method. The defaults value is set to false.\n\n Enable NDES emulation mode (boolean) :\n\nTells whether the NDES emulation mode is enabled or not. The defaults value is set to false.\n\n Enable DN Whitelist * (boolean) :\n\nTells whether the DN whitelist is enabled or not. The default value is set to false.\n\n SCEP protocol parameters\n\n Mode * (select) :\n\nChoose from the two modes RA or CA.\nThe default value is set to RA.\n\n SCEP Authority * (select) :\n\nSelect a previously created SCEP Authority .\n\n CAPS * (select) :\n\nSelect a caps from the list.\nThe default value is set to SHA.\n\n Encryption algorithm * (select) :\n\nSelect an encryption algorithm from the list.\n\n Password policy (select) :\n\nSelect a previously created password policy. It is used for the challenge generation.\n\n Max Certificate per Holder Policy\n\n Maximum (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Behavior (select) :\n\nWhat behavior to have when the maximum number is reached:\n\n revoke the previous certificates.\n\n reject the current request.\n\n Revocation reason (select) :\n\nWhen the revoke behavior is selected, the revocation reason to revoke the certificate with.\n\n Renewal management\n\n Renewal period ( finite duration ) :\n\nMust be a valid finite duration.\n\n Crypto Policy\n\n Default Key Type (select) :\n\nKey Type that will be used by horizon-cli in certificate enrollment.\n\n Authorized Key Types (multiselect) :\n\nKey Types that can be used for enrollment. An empty value means no restrictions.\n\n Common configuration for profiles\n\n Languages\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of this profile.\n\n Description (string input) :\n\nEnter a description. This will be displayed on the list view of the profiles.\n\n You can delete the localization.\n\n Grading Policies\n\n You can select grading policies that will grade your certificate for a quick overview of its quality.\nFor more information about the inner working of the grading policies in Horizon, please refer to the grading rules page .\n\n Workflows builder\n\n Configure custom rights for actions on this profile.\n\n 1. Select an authorization level for each workflow.\n\n Everyone :\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live\n\n Configure the time your requests have before expiring.\n\nAfter expiration, requests are stored for an additional 30 days. This can be changed using configuration files .\n\n Enrollment request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Renewal request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Revocation request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Update request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Migration request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Recover request ( finite duration ) :\n\n Enabled on escrow : Must be a valid finite duration. The default value is set to seven days.\n\n Self Permissions\n\n These permissions apply to the owners of a certificate (team or owner). An owner can always request the following actions, but this permission allows them to perform the action without validation.\n\n Revoke (boolean) :\n\nGrant self revoke permission. The default value is set to false.\n\n Revoke (pop) (boolean) :\n\nGrant self revoke permission with owner being determined by Proof of Possession. This is used by horizon-cli. The default value is set to false.\n\n Update (boolean) :\n\nGrant self update permission. The default value is set to false.\n\n Update (pop) (boolean) :\n\nGrant self update permission with owner being determined by Proof of Possession. This is used by horizon-cli. The default value is set to false.\n\n Constraints\n\n Allowed email domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\nThis matches the domain of the email, not including anything before @ .\n\n Allowed DNS domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n CSR Data Mapping\n\n 1. Click on to add a mapping.\n\n 2. Select a field and enter a value.\n\n You can delete the CSR Data Mapping.\n\n Certificate Template\n\n This section details how to define a custom structure for the fields subject DN , SAN & extensions of the requested certificate in order to match the configuration on the PKI side.\n\nDefining a template will use the CSR to fill the available field. A CSR with unexpected fields will be rejected. Using a template also disables CSR Data Mapping.\n\n Subject DN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Subject DN template.\n\nWhen a template is defined, at least one mandatory Common Name must be added to the DN Elements.\n\n SAN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the element list.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Minimum (int) :\n\nThe minimum number of value that this SAN must have.\n\n Maximum (int) :\n\nThe maximum number of value that this SAN must have.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the SAN template.\n\n Extensions\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Extensions template.\n\nWhen adding a SAN, a DN element or an Extension and making it mandatory, make sure to either give it a default value or a computation rule or make it editable, otherwise the template will be unusable.\n\n Certificate Metadata\n\n This section details how to define a custom structure for the labels, ownership policy and technical metadata, allowing certificates to hold rich information.\n\n Labels\n\n You can add more labels by clicking .\n\n Name (select) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nShould the label be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Open the popup, enter the label value and press \"enter\" to add this value to the accepted value list. An empty whitelist means no restriction.\n\n Suggestions (string input multiple) :\n\nAdd suggestions that will be displayed to the user. The user will be able to choose one of these values or enter its own. Open the popup, enter your suggestions and press enter to add this value to the suggestions. An empty suggestions list means no restriction.\n\n Regex ( regex ) :\n\nThe label value will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this label to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can delete or reorder (drag and drop) the label template.\n\n Ownership policy\n\n Owner\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s owner is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the owner to the value of the evaluated computation rule . This value will override any other value including the user input.\n\n Contact email\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s contact email is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when approving a request.\n\n Default contact email (string input) :\n\nSet a default contact email. This value must comply with the contact email restriction.\n\n Contact email restriction\n\n Whitelist (string input multiple) :\n\nThe contact email will have to be in the whitelist. Open the popup, enter the email and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe contact email will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the contact email to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Team\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s team is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe team will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the team to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Metadata policy (overridable metadata)\n\nThese metadata are technical metadata. They are used by Horizon or Third party connectors, updating them should be done with utmost care.\n\nMetadata edition is not allowed on enroll.\n\nMetadata edition is not available via the User Interface. It must be changed with API, using horizon-cli.\n\n You can allow the override of technical metadata by clicking .\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n You can delete a metadata policy. This will not delete the metadata but will make it non editable.\n\n Notifications\n\n This section details how to configure notifications on certificate and request lifecycle events.\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n Renew\n\n Select a preexisting email or groupware notification to associate it with an event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by an Enroll/Revocation/Update/Migrate/Renew request:\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n Select a preexisting email or groupware notification to associate it with an event.\n\nSubmit request events are not triggered when the user has the permission to perform the action directly.\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the SCEP Profile.\n\n You won’t be able to delete a SCEP Profile if this one is referenced somewhere else.\n\n SCEP Introduction\n WCCE Introduction", - "keywords": [ - "scep", - "profile", - "admin-guide", - "admin-guide/protocols/scep/scep_profile", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:wcce:wcce", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "WCCE Introduction", - "section": "admin-guide", - "slug": "admin-guide/protocols/wcce/wcce", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/wcce/wcce.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/wcce/wcce.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "WCCE", - "WCCE Introduction" - ], - "summary": "WCCE Introduction This section details how to configure and consume the Windows Client Certificate Enrollment (WCCE) protocol. Managing certificate lifecycle through the WCCE protocol involves up to three components: Active Directory asset ", - "content": "WCCE Introduction\n\n This section details how to configure and consume the Windows Client Certificate Enrollment (WCCE) protocol.\n\n Managing certificate lifecycle through the WCCE protocol involves up to three components:\n\n Active Directory asset (domain controller, server, workstation, user) as WCCE Client;\n\n WinHorizon as the Active Directory enrollment service;\n\n Horizon as the WCCE proxy;\n\nWCCE enrollment modes will be detailed later on.\n\n The protocol paradigm can be described as follows: ' every Windows Active Directory member (machines, users) can use DCOM interfaces to interact with a CA to request certificate enrollment '.\n\n The following schema is a simplified workflow of an WCCE enrollment:\n\nThe protocol is based on the notion of Active Directory membership and configuration.\nActive Directory clients (such as machines and users) having rights on Microsoft Certificate Templates can use Active Directory enrollment service through DCOM interface to request certificate enrollment.\n\n Horizon supports different WCCE enrollment modes:\n\n Entity : Certificate’s elements are built using Active Directory content;\n\n Enrollment On Behalf of Others (EOBO) : Certificate signing request (CSR) is signed by one/many Certificate Enrollment Agent(s);\n\n Trust request : Certificate signature request (CSR) content is fully trust and certificate will be created using its content.\n\nFor Enrollment On Behalf of Others (EOBO) enrollment mode, it is possible to configure a whitelist of Authorized CAs trusted as issuers of enrollment agent certificates.\n\n Windows official resources\n\n EverTrust WCCE implementation is based on official WCCE documentation provided by Microsoft:\n\n MS-WCCE: Windows Client Certificate Enrollment Protocol\n\n Prerequisites\n\n WinHorizon should be installed using WinHorizon installation guide ;\n\n WinHorizon and Active Directory should be configured using WinHorizon administration guide .\n\n SCEP Profile\n WCCE Forest", - "keywords": [ - "wcce", - "introduction", - "admin-guide", - "admin-guide/protocols/wcce/wcce", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:wcce:wcce_forest", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "WCCE Forest", - "section": "admin-guide", - "slug": "admin-guide/protocols/wcce/wcce_forest", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/wcce/wcce_forest.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/wcce/wcce_forest.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "WCCE", - "WCCE Forest" - ], - "summary": "WCCE Forest Uses MSAD Connector How to configure WCCE Forest 1. Log in to Horizon Administration Interface. 2. Access WCCE Forest from the drawer or card: Protocol WCCE Forest . 3. Click on . 4. Fill the mandatory fields. Forest Name * (str", - "content": "WCCE Forest\n\n Uses\n\n MSAD Connector\n\n How to configure WCCE Forest\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE Forest from the drawer or card: Protocol   WCCE   Forest .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Forest Name * (string input) :\nEnter the Active Directory forest name.\n\n 5. Click on the save button.\n\n You can duplicate or delete the WCCE Forest.\n\n You won’t be able to delete an WCCE Forest if it is referenced somewhere else.\n\n WCCE Introduction\n WCCE Profile", - "keywords": [ - "wcce", - "forest", - "admin-guide", - "admin-guide/protocols/wcce/wcce_forest", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:wcce:wcce_msad_connector", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "WCCE MSAD Connector", - "section": "admin-guide", - "slug": "admin-guide/protocols/wcce/wcce_msad_connector", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/wcce/wcce_msad_connector.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/wcce/wcce_msad_connector.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "WCCE", - "WCCE MSAD Connector" - ], - "summary": "WCCE MSAD Connector Uses WCCE Scheduled Task Prerequisites WCCE Forest How to configure an MSAD Connector 1. Log in to Horizon Administration Interface. 2. Access MSAD Connectors from the drawer or card: Protocol WCCE MSAD Connectors . 3. C", - "content": "WCCE MSAD Connector\n\n Uses\n\n WCCE Scheduled Task\n\n Prerequisites\n\n WCCE Forest\n\n How to configure an MSAD Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access MSAD Connectors from the drawer or card: Protocol   WCCE   MSAD Connectors .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n General\n\n Name * (select) :\n\nSelect the Active Directory Forrest you want to use to set up the connector.\n\n Hostname * (string input) :\n\nDNS name or IP of the Active Directory domain.\n\n Port (string input) :\n\nPort to connect to the Active Directory. The default value is set to 636.\n\n Proxy (string select) :\n\nSelect a proxy to connect to the Active Directory, if needed.\n\n Bind DN * (string input) :\n\nDN of the Active Directory account. Must have right privileges to browse and list objects.\n\n Password * (string input) :\n\nPassword associated with aforementioned Active Directory DN account.\n\n Timeout * ( finite duration ) :\n\nThe time before Horizon stop trying to connect to Active Directory. Must be a valid finite duration.\n\n Max stored certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Assets identification\n\n Base DN * (string input) :\n\nIt can be the root of your domain or a restriction.\n\n LDAP Filter (string input) :\n\nThis filter must respect LDAP filter syntax.\n\n Actor management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be requested more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nThe default value is set to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nThe default value is set to 3.\n\n 5. Click on the save button.\n\n You can update or delete the MSAD Connector.\n\n You won’t be able to delete a MSAD Connector if this one is referenced somewhere else.\n\n WCCE Test enrollment\n WCCE Scheduled Tasks", - "keywords": [ - "wcce", - "msad", - "connector", - "admin-guide", - "admin-guide/protocols/wcce/wcce_msad_connector", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:wcce:wcce_profile", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "WCCE Profile", - "section": "admin-guide", - "slug": "admin-guide/protocols/wcce/wcce_profile", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/wcce/wcce_profile.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/wcce/wcce_profile.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "WCCE", - "WCCE Profile" - ], - "summary": "WCCE Profile Uses WCCE Template Mapping WCCE Scheduled Task Prerequisites PKI Connector How to configure a WCCE Profile 1. Log in to Horizon Administration Interface. 2. Access WCCE Profile from the drawer or card: Protocol WCCE Profiles . ", - "content": "WCCE Profile\n\n Uses\n\n WCCE Template Mapping\n\n WCCE Scheduled Task\n\n Prerequisites\n\n PKI Connector\n\n How to configure a WCCE Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE Profile from the drawer or card: Protocol   WCCE   Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n WCCE Profile Specific Configuration\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of an URL, it is advisable to use only lower case letters and dashes.\n\n Enable * (boolean) :\n\nIndicates whether the profile is enabled or not. The default value is set to true.\n\n PKI Connector (string select) :\n\nSelect a PKI connector previously created.\n\n Exchange certificate * (select) :\n\n Enabled on escrow : Select a preexisting Exchange Certificate or create one with the .\n\n Crypto Policy\n\n Authorized Key Types (multiselect) :\n\nKey Types that can be used for enrollment. An empty value means no restrictions.\n\n Private key escrowing (boolean) :\n\nTells whether the private key should be escrowed by Horizon.\nThe default value is set to false.\n\nThis can only be enabled using an Evertrust Stream PKI connector.\n\n Show PKCS#12 Password On Recover (boolean) :\n\nTells whether the PKCS#12 password should be displayed on recover.\nThe default value is set to false.\n\n Show PKCS#12 On Recover (boolean) :\n\nTells whether the PKCS#12 should be displayed on recover.\nThe default value is set to false.\n\n PKCS#12 Password Mode * (select) :\n\nSelect how to generate PKCS#12 password:\n\n manual : prompt the user to choose its password. This is the default behavior.\n\n random : have the password generated on Horizon side.\n\n Password policy (select) :\n\nSelect a previously created password policy. It will be enforced on PKCS#12 password for recovery and centralized enrollments.\n\n Store encryption type * (select) :\n\nSelect an encryption algorithm from the list. The PKCS#12 will use this algorithm.\nThe default value is set to DES_AVERAGE.\n\n Max Certificate per Holder Policy\n\n Maximum (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Behavior (select) :\n\nWhat behavior to have when the maximum number is reached:\n\n revoke the previous certificates.\n\n reject the current request.\n\n Revocation reason (select) :\n\nWhen the revoke behavior is selected, the revocation reason to revoke the certificate with.\n\n Common configuration for profiles\n\n Languages\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of this profile.\n\n Description (string input) :\n\nEnter a description. This will be displayed on the list view of the profiles.\n\n You can delete the localization.\n\n Grading Policies\n\n You can select grading policies that will grade your certificate for a quick overview of its quality.\nFor more information about the inner working of the grading policies in Horizon, please refer to the grading rules page .\n\n Workflows builder\n\n Configure custom rights for actions on this profile.\n\n 1. Select an authorization level for each workflow.\n\n Everyone :\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live\n\n Configure the time your requests have before expiring.\n\nAfter expiration, requests are stored for an additional 30 days. This can be changed using configuration files .\n\n Enrollment request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Renewal request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Revocation request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Update request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Migration request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Recover request ( finite duration ) :\n\n Enabled on escrow : Must be a valid finite duration. The default value is set to seven days.\n\n Self Permissions\n\n These permissions apply to the owners of a certificate (team or owner). An owner can always request the following actions, but this permission allows them to perform the action without validation.\n\n Revoke (boolean) :\n\nGrant self revoke permission. The default value is set to false.\n\n Recover (boolean) :\n\nGrant self recover permission. The default value is set to false.\n\n Update (boolean) :\n\nGrant self update permission. The default value is set to false.\n\n Constraints\n\n Allowed email domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\nThis matches the domain of the email, not including anything before @ .\n\n Allowed DNS domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n CSR Data Mapping\n\n 1. Click on to add a mapping.\n\n 2. Select a field and enter a value.\n\n You can delete the CSR Data Mapping.\n\n Certificate Template\n\n This section details how to define a custom structure for the fields subject DN , SAN & extensions of the requested certificate in order to match the configuration on the PKI side.\n\nDefining a template will use the CSR to fill the available field. A CSR with unexpected fields will be rejected. Using a template also disables CSR Data Mapping.\n\n Subject DN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Subject DN template.\n\nWhen a template is defined, at least one mandatory Common Name must be added to the DN Elements.\n\n SAN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the element list.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Minimum (int) :\n\nThe minimum number of value that this SAN must have.\n\n Maximum (int) :\n\nThe maximum number of value that this SAN must have.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the SAN template.\n\n Extensions\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Extensions template.\n\nWhen adding a SAN, a DN element or an Extension and making it mandatory, make sure to either give it a default value or a computation rule or make it editable, otherwise the template will be unusable.\n\n Certificate Metadata\n\n This section details how to define a custom structure for the labels, ownership policy and technical metadata, allowing certificates to hold rich information.\n\n Labels\n\n You can add more labels by clicking .\n\n Name (select) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nShould the label be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Open the popup, enter the label value and press \"enter\" to add this value to the accepted value list. An empty whitelist means no restriction.\n\n Suggestions (string input multiple) :\n\nAdd suggestions that will be displayed to the user. The user will be able to choose one of these values or enter its own. Open the popup, enter your suggestions and press enter to add this value to the suggestions. An empty suggestions list means no restriction.\n\n Regex ( regex ) :\n\nThe label value will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this label to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can delete or reorder (drag and drop) the label template.\n\n Ownership policy\n\n Owner\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s owner is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the owner to the value of the evaluated computation rule . This value will override any other value including the user input.\n\n Contact email\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s contact email is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when approving a request.\n\n Default contact email (string input) :\n\nSet a default contact email. This value must comply with the contact email restriction.\n\n Contact email restriction\n\n Whitelist (string input multiple) :\n\nThe contact email will have to be in the whitelist. Open the popup, enter the email and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe contact email will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the contact email to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Team\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s team is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe team will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the team to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Metadata policy (overridable metadata)\n\nThese metadata are technical metadata. They are used by Horizon or Third party connectors, updating them should be done with utmost care.\n\nMetadata edition is not allowed on enroll.\n\nMetadata edition is not available via the User Interface. It must be changed with API, using horizon-cli.\n\n You can allow the override of technical metadata by clicking .\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n You can delete a metadata policy. This will not delete the metadata but will make it non editable.\n\n Notifications/Triggers\n\n This section details how to configure notifications and triggers to perform actions on certificate and request lifecycle events.\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n Renew\n\n Select a preexisting email or groupware notification to associate it with an event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by an Enroll/Revocation/Update/Migrate/Renew request:\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n Select a preexisting email or groupware notification to associate it with an event.\n\nSubmit request events are not triggered when the user has the permission to perform the action directly.\n\n Triggers\n\n Horizon support the use of third-party triggers in the form of callbacks on specific events happening on the profile, giving a way to synchronize the third party repositories and Horizon.\n\n Enrollment (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate is enrolled on this profile.\n\n Renewal (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate is renewed on this profile.\n\n Revocation (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate gets revoked on this profile.\n\n Expire (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate expires on this profile.\n\n The available triggers are the following:\n\n AKV Trigger\n\n AWS Trigger\n\n F5 Trigger\n\n LDAP Triggers\n\n On WebRA and Intune PKCS only: Intune PKCS Trigger\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the WCCE Profile .\n\n You won’t be able to delete a WCCE Profile if this one is referenced somewhere else.\n\n WCCE Forest\n WCCE Template Mapping", - "keywords": [ - "wcce", - "profile", - "admin-guide", - "admin-guide/protocols/wcce/wcce_profile", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:wcce:wcce_schedule_tasks", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "WCCE Scheduled Tasks", - "section": "admin-guide", - "slug": "admin-guide/protocols/wcce/wcce_schedule_tasks", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/wcce/wcce_schedule_tasks.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/wcce/wcce_schedule_tasks.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "WCCE", - "WCCE Scheduled Tasks" - ], - "summary": "WCCE Scheduled Tasks This section details how to schedule tasks that will run periodically on your WCCE profiles. You will be able to use MSAD Connector to browse Active Directory and retrieve changes (basically computer removal) to trigger", - "content": "WCCE Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically on your WCCE profiles. You will be able to use MSAD Connector to browse Active Directory and retrieve changes (basically computer removal) to trigger certificate revocation.\nThis mechanism works using comparison between Active Directory content (using MSAD connector) and Horizon certificate list based on a specific WCCE profile.\nIf Horizon has a certificate for a holder that does not exist on Active Directory side a revocation will be triggered automatically.\n\n Prerequisites\n\n WCCE Forest\n\n WCCE Profile\n\n WCCE MSAD Connector\n\n How to configure WCCE Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE scheduled tasks from the drawer or card: Protocol   WCCE   Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n WCCE Profile * (select) :\n\nSelect the target WCCE profile.\n\n Target Connector * (select) :\n\nSelect the MSAD connector to use as golden source of active Active Directory objects.\n\n Cron scheduling in Quartz format ( cron expression ) :\n\nEnter a Cron scheduling expression (in Quartz format). Default value is every 5 hours.\n\n Revoke (boolean) :\n\nIf true, will revoke all certificate that do not exist on the AD side.\n\n Dry run (boolean) :\n\nIf enabled, revocation actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run , update or delete the Schedules Tasks.\n\n WCCE MSAD Connector\n WebRA Introduction", - "keywords": [ - "wcce", - "scheduled", - "tasks", - "admin-guide", - "admin-guide/protocols/wcce/wcce_schedule_tasks", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:wcce:wcce_template", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "WCCE Template Mapping", - "section": "admin-guide", - "slug": "admin-guide/protocols/wcce/wcce_template", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/wcce/wcce_template.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/wcce/wcce_template.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "WCCE", - "WCCE Template Mapping" - ], - "summary": "WCCE Template Mapping The third and last step is to configure mapping between Microsoft Certificate Template configured on Active Directory and Horizon WCCE profile. A mapping is created using a specific enrollment mode. As a result of this", - "content": "WCCE Template Mapping\n\n The third and last step is to configure mapping between Microsoft Certificate Template configured on Active Directory and Horizon WCCE profile. A mapping is created using a specific enrollment mode.\nAs a result of this mapping, every Microsoft Certificate Template can issue certificate from different PKI (using PKI connector of WCCE profile associated to Microsoft Certificate Template).\n\n Prerequisites\n\n WCCE Forest\n\n WCCE Profile\n\n How to configure WCCE Template Mapping\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WCCE Forest from the drawer or card: Protocol   WCCE   Forest .\n\n 3. Identify the section corresponds to the forest for which you want to add mapping. Click on + button.\n\n 4. Fill the mandatory fields.\n\n Microsoft Template Name * (string input) :\n\nEnter the Microsoft Certificate Template name created on Active Directory side.\n\n Enrollment mode (select) :\n\nSpecify the enrollment mode of this mapping.\n\n EOBO CAs (select) :\n\nSpecify the CA(s) to use for EOBO enrolment.\n\n Profile * (select) :\n\nSelect a previously created WCCE profile.\n\n 5. Click on the save button.\n\n You can edit or delete the WCCE Template mapping.\n\n WCCE Profile\n WCCE Test enrollment", - "keywords": [ - "wcce", - "template", - "mapping", - "admin-guide", - "admin-guide/protocols/wcce/wcce_template", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:wcce:wcce_test", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "WCCE Test enrollment", - "section": "admin-guide", - "slug": "admin-guide/protocols/wcce/wcce_test", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/wcce/wcce_test.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/wcce/wcce_test.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "WCCE", - "WCCE Test enrollment" - ], - "summary": "WCCE Test enrollment This section details how to use the Microsoft Management Console (MMC) to manually retrieve a certificate through WCCE using different enrollment modes. If you want to enroll machine certificate you need to perform the ", - "content": "WCCE Test enrollment\n\n This section details how to use the Microsoft Management Console (MMC) to manually retrieve a certificate through WCCE using different enrollment modes.\nIf you want to enroll machine certificate you need to perform the following actions using Administrator Account.\n\n 1. Launch mmc.exe\n\n 2. Click on File > Add/Remove or Remove Snap-ins\n\n 3. On the left panel, click on Certificates then Add\n\nIf you don’t have administrative privileges, the User certificate store will be automatically chosen.\nIf your account has administrative privileges, it will be prompted a window to choose Microsoft Certificate Store to use.\nIf you want to enroll User certificate please chose My user account .\nIf you want to enroll Machine certificate (computer or IIS for example) please chose Computer account .\n\n 4. Navigate to Personal   Certificates\n\n 5. Right click on Windows and chose All tasks   Request certificate\n\n 6. Click on Next\n\n 7. On the next step, let default enrollment policy configuration, then click on Next\n\n The next step lists all Microsoft Certificate Templates on which you have enrollment rights.\nThe Microsoft Certificate template selection and last parts of this testing procedure are specific to the enrollment mode you want to perform.\n\n Please refer to the proper section below.\n\n Requesting a certificate using 'Entity' enrollment mode\n\n 8. Select the Microsoft Certificate Template configured on Horizon side as a part of a Template Mapping using Entity enrollment mode. Click on Next\n\n 9. Click on Enroll to request Enrollment.\n\n 10. Enrollment is requested to WinHorizon. Few seconds later, if enrollment is successful it will be displayed STATUS: Succeeded . Click on Finish .\n\n 11. Your certificate is displayed and available.\n\n Requesting a certificate using 'Enrollment On Behalf of Others' enrollment mode\n\n 8. Identify the Microsoft Certificate Template configured on Horizon side as a part of a Template Mapping using Enrollment On Behalf of Others (EOBO) enrollment mode. Click on Details then Properties .\n\n 9. Navigate to Extensions tab and select Enrollment Agent Certificate (to be used to sign Certificate Request). Click on OK .\n\n 10. Click on Enroll to request Enrollment.\n\n 11. Enrollment is requested to WinHorizon. Few seconds later, if enrollment is successful it will be displayed STATUS: Succeeded . Click on Finish .\n\n 12. Your certificate is displayed and available.\n\n Requesting a certificate using 'Trust request' enrollment mode\n\n 8. Identify the Microsoft Certificate Template configured on Horizon side as a part of a Template Mapping using Trust request enrollment mode. Click on Details then Properties .\n\n 9. Navigate to Subject tab to build your Certificate request manually. Click on OK .\n\n 10. Click on Enroll to request Enrollment.\n\n 11. Enrollment is requested to WinHorizon. Few seconds later, if enrollment is successful it will be displayed STATUS: Succeeded . Click on Finish .\n\n 12. Your certificate is displayed and available.\n\n WCCE Template Mapping\n WCCE MSAD Connector", - "keywords": [ - "wcce", - "test", - "enrollment", - "admin-guide", - "admin-guide/protocols/wcce/wcce_test", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:webra:webra", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "WebRA Introduction", - "section": "admin-guide", - "slug": "admin-guide/protocols/webra/webra", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/webra/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/webra/webra.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "WebRA", - "WebRA Introduction" - ], - "summary": "WebRA Introduction WebRA is a powerful protocol designed by EverTrust. It allows a validation process with edition of all certificate fields, to perform enrollments with user friendly web interfaces on Horizon Registration Authority portal.", - "content": "WebRA Introduction\n\n WebRA is a powerful protocol designed by EverTrust. It allows a validation process with edition of all certificate fields, to perform enrollments with user friendly web interfaces on Horizon Registration Authority portal.\n\n WCCE Scheduled Tasks\n WebRA Profile", - "keywords": [ - "webra", - "introduction", - "admin-guide", - "admin-guide/protocols/webra/webra", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:webra:webra_profile", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "WebRA Profile", - "section": "admin-guide", - "slug": "admin-guide/protocols/webra/webra_profile", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/webra/webra_profile.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/webra/webra_profile.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "WebRA", - "WebRA Profile" - ], - "summary": "WebRA Profile This section details how to configure the WebRA Profile. Required By WebRA Scheduled Task Prerequisites PKI Connector How to configure WebRA Profile 1. Log in to Horizon Administration Interface. 2. Access WebRA Profiles from ", - "content": "WebRA Profile\n\n This section details how to configure the WebRA Profile.\n\n Required By\n\n WebRA Scheduled Task\n\n Prerequisites\n\n PKI Connector\n\n How to configure WebRA Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access WebRA Profiles from the drawer or card: Protocols   WebRA   Profiles .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Profile specific configuration\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name, this setting will be the profile identifier. It must be unique for each profile.\n\n Enable (boolean) :\n\nShould the profile be enabled. The default value is set to true.\n\n WebRA Template * (select) :\n\nSelect a previously created WebRA Template.\n\n PKI Connector (string select) :\n\nSelect a previously created PKI connector .\n\n Max certificate per holder (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Crypto Policy\n\n Default Key Type (select) :\n\nSelect the default type of key to generate when using centralized enrollment mode.\n\n Authorized Key Types (multiselect) :\n\nKey Types that can be used for enrollment. An empty value means no restrictions.\n\n Centralized enrollment (boolean) :\n\nTells whether the profile should be used with a centralized enrollment, i.e providing a PKCS#12.\nThe default value is set to false.\n\n Private key escrowing (boolean) :\n\nTells whether the private key should be escrowed by Horizon.\nThe default value is set to false.\n\n Show PKCS#12 Password On Enroll (boolean) :\n\nTells whether the PKCS#12 password should be displayed on enroll. The default value is set to false.\n\n Show PKCS#12 On Enroll (boolean) :\n\nTells whether the PKCS#12 should be displayed on enroll. The default value is set to false.\n\n Show PKCS#12 Password On Recover (boolean) :\n\nTells whether the PKCS#12 password should be displayed on recover.\nThe default value is set to false.\n\n Show PKCS#12 On Recover (boolean) :\n\nTells whether the PKCS#12 should be displayed on recover.\nThe default value is set to false.\n\n PKCS#12 Password Mode * (select) :\n\nSelect how to generate PKCS#12 password:\n\n manual : prompt the user to choose its password. This is the default behavior.\n\n random : have the password generated on Horizon side.\n\n Password policy (select) :\n\nSelect a previously created password policy. It will be enforced on PKCS#12 password for recovery and centralized enrollments.\n\n Store encryption type * (select) :\n\nSelect an encryption algorithm from the list. The PKCS#12 will use this algorithm.\nThe default value is set to DES_AVERAGE.\n\n Decentralized enrollment (boolean) :\n\nTells whether the profile should be used with a decentralized enrollment mode, i.e CSR (PKCS#10) signing by the PKI.\nThe default value is set to true.\n\n Common configuration for profiles\n\n Languages\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of this profile.\n\n Description (string input) :\n\nEnter a description. This will be displayed on the list view of the profiles.\n\n You can delete the localization.\n\n Grading Policies\n\n You can select grading policies that will grade your certificate for a quick overview of its quality.\nFor more information about the inner working of the grading policies in Horizon, please refer to the grading rules page .\n\n Workflows builder\n\n Configure custom rights for actions on this profile.\n\n 1. Select an authorization level for each workflow.\n\n Everyone :\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live\n\n Configure the time your requests have before expiring.\n\nAfter expiration, requests are stored for an additional 30 days. This can be changed using configuration files .\n\n Enrollment request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Renewal request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Revocation request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Update request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Migration request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Recover request ( finite duration ) :\n\n Enabled on escrow : Must be a valid finite duration. The default value is set to seven days.\n\n Self Permissions\n\n These permissions apply to the owners of a certificate (team or owner). An owner can always request the following actions, but this permission allows them to perform the action without validation.\n\n Revoke (boolean) :\n\nGrant self revoke permission. The default value is set to false.\n\n Revoke (pop) (boolean) :\n\nGrant self revoke permission with owner being determined by Proof of Possession. This is used by horizon-cli. The default value is set to false.\n\n Recover (boolean) :\n\nGrant self recover permission. The default value is set to false.\n\n Update (boolean) :\n\nGrant self update permission. The default value is set to false.\n\n Update (pop) (boolean) :\n\nGrant self update permission with owner being determined by Proof of Possession. This is used by horizon-cli. The default value is set to false.\n\n Renew (boolean) :\n\nGrant self renew permission. The default value is set to false.\n\n Renew (pop) (boolean) :\n\nGrant self renew permission with owner being determined by Proof of Possession. This is used by horizon-cli. The default value is set to false.\n\n CSR Data Mapping\n\n 1. Click on to add a mapping.\n\n 2. Select a field and enter a value.\n\n You can delete the CSR Data Mapping.\n\n Certificate Template\n\n This section details how to define a custom structure for the fields subject DN , SAN & extensions of the requested certificate in order to match the configuration on the PKI side.\n\nIn a WebRA profile, defining a template is mandatory.\n\n Subject DN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Subject DN template.\n\nWhen a template is defined, at least one mandatory Common Name must be added to the DN Elements.\n\n SAN composition\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the element list.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Minimum (int) :\n\nThe minimum number of value that this SAN must have.\n\n Maximum (int) :\n\nThe maximum number of value that this SAN must have.\n\n Regex ( regex ) :\n\nEnter a regular expression that the element should match.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the SAN template.\n\n Extensions\n\n You can add more elements by clicking .\n\n Element * (select) :\n\nSelect an attribute from the elements list.\n\n Mandatory (boolean) :\n\nShould the element be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the element should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the element should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the element.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this element to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can remove an element by clicking the delete button or reorder (drag and drop) the Extensions template.\n\nWhen adding a SAN, a DN element or an Extension and making it mandatory, make sure to either give it a default value or a computation rule or make it editable, otherwise the template will be unusable.\n\n Certificate Metadata\n\n This section details how to define a custom structure for the labels, ownership policy and technical metadata, allowing certificates to hold rich information.\n\n Labels\n\n You can add more labels by clicking .\n\n Name (select) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nShould the label be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Open the popup, enter the label value and press \"enter\" to add this value to the accepted value list. An empty whitelist means no restriction.\n\n Suggestions (string input multiple) :\n\nAdd suggestions that will be displayed to the user. The user will be able to choose one of these values or enter its own. Open the popup, enter your suggestions and press enter to add this value to the suggestions. An empty suggestions list means no restriction.\n\n Regex ( regex ) :\n\nThe label value will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this label to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can delete or reorder (drag and drop) the label template.\n\n Ownership policy\n\n Owner\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s owner is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the owner to the value of the evaluated computation rule . This value will override any other value including the user input.\n\n Contact email\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s contact email is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when approving a request.\n\n Default contact email (string input) :\n\nSet a default contact email. This value must comply with the contact email restriction.\n\n Contact email restriction\n\n Whitelist (string input multiple) :\n\nThe contact email will have to be in the whitelist. Open the popup, enter the email and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe contact email will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the contact email to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Team\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s team is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe team will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the team to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Metadata policy (overridable metadata)\n\nThese metadata are technical metadata. They are used by Horizon or Third party connectors, updating them should be done with utmost care.\n\nMetadata edition is not allowed on enroll.\n\nMetadata edition is not available via the User Interface. It must be changed with API, using horizon-cli.\n\n You can allow the override of technical metadata by clicking .\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n You can delete a metadata policy. This will not delete the metadata but will make it non editable.\n\n Notifications/Triggers\n\n This section details how to configure notifications and triggers to perform actions on certificate and request lifecycle events.\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n Renew\n\n Select a preexisting email or groupware notification to associate it with an event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by an Enroll/Revocation/Update/Migrate/Renew request:\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n Select a preexisting email or groupware notification to associate it with an event.\n\nSubmit request events are not triggered when the user has the permission to perform the action directly.\n\n Triggers\n\n Horizon support the use of third-party triggers in the form of callbacks on specific events happening on the profile, giving a way to synchronize the third party repositories and Horizon.\n\n Enrollment (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate is enrolled on this profile.\n\n Renewal (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate is renewed on this profile.\n\n Revocation (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate gets revoked on this profile.\n\n Expire (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate expires on this profile.\n\n The available triggers are the following:\n\n AKV Trigger\n\n AWS Trigger\n\n F5 Trigger\n\n LDAP Triggers\n\n On WebRA and Intune PKCS only: Intune PKCS Trigger\n\n 5. Click on the save button.\n\n You can edit , duplicate or delete the WebRA Profile.\n\n You won’t be able to delete a WebRA Profile if it is referenced somewhere else.\n\n WebRA Introduction\n WebRA Scheduled Tasks", - "keywords": [ - "webra", - "profile", - "admin-guide", - "admin-guide/protocols/webra/webra_profile", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:protocols:webra:webra_schedule_tasks", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "WebRA Scheduled Tasks", - "section": "admin-guide", - "slug": "admin-guide/protocols/webra/webra_schedule_tasks", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/protocols/webra/webra_schedule_tasks.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/protocols/webra/webra_schedule_tasks.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Protocols", - "WebRA", - "WebRA Scheduled Tasks" - ], - "summary": "WebRA Scheduled Tasks This section details how to schedule tasks that will run periodically with your WebRA profiles. Prerequisites AWS Connector Azure AKV Connector F5 Connector WebRA Profile How to configure WebRA Scheduled Tasks 1. Log i", - "content": "WebRA Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically with your WebRA profiles.\n\n Prerequisites\n\n AWS Connector\n\n Azure AKV Connector\n\n F5 Connector\n\n WebRA Profile\n\n How to configure WebRA Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access the \"Scheduled tasks\" from the drawer or card: Protocols   WebRA   Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n WebRA Profile * (select) :\n\nSelect a previously created WebRA profile.\n\n Target Connector * (select) :\n\nSelect a previously created third party connector.\n\n Cron scheduling ( cron expression ) :\n\nEnter a Cron scheduling expression (in Quartz format). The default expression is built to run the task every 5 hours.\n\n Revoke (boolean) :\n\nIf enabled, will revoke all certificate whose container was deleted from the third party repository.\nThe default value is set to false.\n\n Renew (boolean) :\n\nIf enabled, will renew all certificate who are about to expire. The default value is set to false.\n\n Dry run (boolean) :\n\nIf enabled, revocation and renewal actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run or edit or delete the Schedules Tasks.\n\n WebRA Profile\n AWS Introduction", - "keywords": [ - "webra", - "scheduled", - "tasks", - "admin-guide", - "admin-guide/protocols/webra/webra_schedule_tasks", - "horizon", - "admin", - "guide", - "protocols" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:reports", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Reports", - "section": "admin-guide", - "slug": "admin-guide/reports", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/reports.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/reports.html", - "breadcrumbs": ["Horizon", "Admin guide", "Reports"], - "summary": "Reports A report is a CSV file sent in a scheduled email. The CSV content is managed by: HCQL query (certificates), HRQL query (requests) CSV fields shown Prerequisites You may need Teams . How to configure Reports 1. Log in to Horizon Admi", - "content": "Reports\n\n A report is a CSV file sent in a scheduled email. The CSV content is managed by:\n\n HCQL query (certificates), HRQL query (requests)\n\n CSV fields shown\n\n Prerequisites\n\n You may need Teams .\n\n How to configure Reports\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Reports from the drawer or card: Reports .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Details\n\n Enable (boolean) :\n\nTells whether the reporting task should be enabled. Set by default at true.\n\n Name * (string input) :\n\nEnter a meaningful report name. It must be unique.\n\n Cron scheduling expression in Quartz format * ( cron expression ) :\n\nEnter a Cron scheduling expression (in Quartz format). The default expression is built to run the task every hour.\n\n Recipients\n\n Click on to add a recipient.\n\n You can either target:\n\n A static (recipient): you will need to set a valid email address.\n\n A team contact: you will need to select one of the enabled teams.\n\n A team manager: you will need to select one of the enabled teams.\n\n Email\n\n From * (string input) :\n\nEnter the email address that will appear in the \"From\" field of the email.\n\n Subject * (string input) :\n\nEnter the subject of the email.\n\n Body (string input) :\n\nEnter the body of the email.\n\n CSV file name (string input) :\n\nEnter the name that will be given to the attached csv file.\n\n Is HTML (boolean) : (boolean):\n\nSets whether the email body contains HTML code (true) or plain text (false). The default value is set to false.\n\n HQL\n\n HQL Type * (select) :\n\nEither chose Certificate or Request. It will define the HQL Query type to set and the enabled CSV fields.\n\n Query (string input or select) :\n\nHCQL (Certificate) or HRQL (Request). You can select one of your saved queries.\n\n CSV\n\n You can select which fields will appear on the CSV file.\n\n 5. Click on the save button.\n\n You can run , edit or delete the report .\n\n Computation rule\n Overridable configuration parameters", - "keywords": [ - "reports", - "admin-guide", - "admin-guide/reports", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:security:accounts", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Local Accounts", - "section": "admin-guide", - "slug": "admin-guide/security/accounts", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/security/accounts.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/accounts.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Local Accounts"], - "summary": "Local Accounts This section details how to configure the EverTrust Horizon local accounts and set their password. Local accounts are useful to create technical accounts, such as required by horizon-cli for some scenarios (e.g. Scan/Discover", - "content": "Local Accounts\n\n This section details how to configure the EverTrust Horizon local accounts and set their password.\n\n Local accounts are useful to create technical accounts, such as required by horizon-cli for some scenarios (e.g. Scan/Discovery)\n\n How to create local accounts\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Local accounts from the drawer or card: Security   Access Management   Local Accounts .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Identifier * (string input) :\n\nEnter a meaningful identifier for the account holder. It will be used as a login to access to the solution.\n\n Name (string input) :\n\nEnter a meaningful name for the account holder.\n\n Email (string input) :\n\nEnter the account holder email.\n\n 5. Click on the save button.\n\n How to set a password to a local account\n\n 1. Once a local account is created. Click on .\n\n 2. Fill in the mandatory fields.\n\n Password * (string input) :\n\nSet a password.\n\n Confirm password * (string input) :\n\nConfirm the password.\n\n 3. Click on the save button.\n\n You can edit or delete a local account. You can manage a local account password.\n\n You can not delete yourself from local accounts.\n\n Sectigo CMS\n Authorization", - "keywords": [ - "local", - "accounts", - "admin-guide", - "admin-guide/security/accounts", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:security:authorization", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Authorization", - "section": "admin-guide", - "slug": "admin-guide/security/authorization", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/security/authorization.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/authorization.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Authorization"], - "summary": "Authorization This section details how to configure the permissions granted to an account, either directly or through a configured role. Prerequisites According to the context, you might need to set up: Roles Local accounts How to add an au", - "content": "Authorization\n\n This section details how to configure the permissions granted to an account, either directly or through a configured role.\n\n Prerequisites\n\n According to the context, you might need to set up:\n\n Roles\n\n Local accounts\n\n How to add an authorization manually or from a certificate\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Authorizations from the drawer or card: Security   Access Management   Authorizations .\n\n 3. Click on .\n\n 4. Click on Add Authorization Manually\n\n 5. Fill the mandatory fields.\n\n Either:\n\n Fill in an Identifier * (string input or import) :\n\nEnter a meaningful identifier. It can be either a local account identifier or an OpenID Connect identifier (usually email address).\n\n Import a certificate by clicking on certificate button .\n\n Contact email (string input) :\n\nEnter the contact email for the account.\n\n 6 . Click on add button.\n\n How to add an authorization from a search\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Authorizations from the drawer or card: Security   Access Management   Authorizations .\n\n 3. Click on .\n\n 4. Click on Search and Add Authorization\n\n 5. Fill one of the fields.\n\n Identifier * (string input) :\n\nEnter the identifier of the account to look for.\n\n Email * (string input) :\n\nEnter the email of the account to look for.\n\n 6 . Click on search button.\n\n 7 . Choose the identifier you want to add.\n\n 8 . Click on add button.\n\n You can update or delete Authorization.\n\n How to grant a permission\n\n 1. Click on .\n\n Role\n\n 2. Select a role previously created (if needed).\n\n Team\n\n 3. Select a team previously created (if needed).\n\n Configuration\n\n You can build here a configuration permission. The permission follows the pattern: Section / Module / Right.\n\n 4. Click on add button.\n\n 5. Select a section, then a module, then a submodule if there is, and a right.\n\n 6. Click on add button (Don’t forget to save).\n\n 7. Click on the save button if you are done.\n\n Lifecycle\n\n You can build here a lifecycle permission. The permission follows the pattern: Module / Profile / Right. You can further restrict the permission by adding a filter from the \"Horizon Permission Query Language\".\n\n 4. Click on add button.\n\n 5. Select a module, then a profile, and a right.\n\n 6. Click on add button. (don’t forget to save).\n\n 7. Click on the save button if you are done.\n\n Horizon requests lifecycle:\n\n Discovery\n\n You can build here a discovery permission. The permission follows the pattern: Module / Discovery campaign name / Right.\n\n 4. Click on add button.\n\n 5. Select a module, then a campaign, and a right.\n\n 6. Click on add button. (don’t forget to save)\n\n 7. Click on the save button if you are done.\n\n Local Accounts\n Roles", - "keywords": [ - "authorization", - "admin-guide", - "admin-guide/security/authorization", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:security:policies", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Password Policies", - "section": "admin-guide", - "slug": "admin-guide/security/policies", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/security/policies.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/policies.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Security", - "Password Policies" - ], - "summary": "Password Policies This section details how to configure password policies that will be used by Horizon. How to configure a Password Policy 1. Log in to Horizon Administration Interface. 2. Access Password Policies from the drawer or card: S", - "content": "Password Policies\n\n This section details how to configure password policies that will be used by Horizon.\n\n How to configure a Password Policy\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Password Policies from the drawer or card: Security   Password Policies .\n\n 3. Click on .\n\n 4. Fill in the mandatory fields.\n\n Name *:\n\nEnter a meaningful password policy name;\n\n Password range length * (int) :\n\nPassword length (0 is unlimited);\n\n Minimum of lowercase (int) :\n\nMinimum of lowercase characters in the password;\n\n Minimum of uppercase (int) :\n\nMinimum of uppercase characters in the password;\n\n Minimum of digit (int) :\n\nMinimum of digit in the password;\n\n Minimum of special character (int) :\n\nMinimum of special characters in the password;\n\n Special characters accepted (string input) :\n\nWhitelist of special characters accepted in the password.\n\n 5. Click on the save button.\n\n You can update or delete the Password Policy.\n\n You won’t be able to delete a Password Policy if it is referenced in any other configuration element.\n\n Roles\n Identity Providers Configuration", - "keywords": [ - "password", - "policies", - "admin-guide", - "admin-guide/security/policies", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:security:providers", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Identity Providers Configuration", - "section": "admin-guide", - "slug": "admin-guide/security/providers", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/security/providers.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/providers.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Security", - "Identity Providers Configuration" - ], - "summary": "Identity Providers Configuration This section details how to configure Identity Providers. Identity Providers are going to be used by Horizon to verify the identity of an end-user based on the authentication performed by an external authori", - "content": "Identity Providers Configuration\n\n This section details how to configure Identity Providers.\nIdentity Providers are going to be used by Horizon to verify the identity of an end-user based on the authentication performed by an external authorization server.\n\n How to configure an Identity Provider\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Identity Providers from the drawer or card: Security   Access Management   Identity Providers .\n\n 3. Click on .\n\n General tab\n\n 4. Select an identity provider type. Currently only OpenID is supported\n\n OpenID connect\n\n 5. Fill in all mandatory fields:\n\n Name * (string input) :\n\nEnter a meaningful identity provider name.\n\n Provider metadata URL * (string input) :\n\nEnter the OpenID Connect provider metadata URL.\n\n Client ID * (string input) :\n\nIdentifier generated on the OpenID Connect IDP when setting up a new application (Horizon) to authenticate users on the identity provider.\n\n Client Secret * (string input) :\n\nPassword associated to the aforementioned identifier (Client ID);\n\n Scope * (string input) :\n\nScope used by Horizon during authentication on the identity provider to authorize access to user’s details.\n\n Proxy (string select) :\n\n Proxy used to access Provider metadata URL, if any.\n\n Timeout ( finite duration ) :\n\nTimeout used for authentication on the identity provider. Must be a valid finite duration. By default 10 seconds.\n\n Identifier Claim * (string input) :\n\nDynamic expression defining how to construct the identifier from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user identifier is contained in the login claim, then the configured value should be {{login}} .\n\n Email Claim * (string input) :\n\nDynamic expression defining how to construct the user email from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user email is contained in the 'email' claim, then the configured value should be {{email}} . If the email is not available directly from the claims but can be computed from the 'login' claim by appending a domain, the configured value should be {{login}}@evertrust.fr .\n\n Name Claim * (string input) :\n\nDynamic expression defining how to construct the username from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user name must be constructed as family name, given name and family name is available in the family_name claim, given name is available in the given_name claim, then the configured value should be {{family_name}}, {{given_name}} .\n\n Enable * (boolean) :\n\nEnable/Disable the identity provider.\n\n Enabled on UI * (boolean) :\n\nEnable/Disable the identity provider on user interface.\n\n Languages tab\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of the provider on the login page.\n\n Description (string input) :\n\nEnter a description. This will be displayed in a tooltip when the provider is chosen on the login page.\n\n You can delete the localization.\n\n 6. Click on the save button.\n\n You can update or delete the Identity Provider.\n\n You won’t be able to delete an Identity Provider if it is referenced in any other configuration element.\n\n Password Policies\n Teams", - "keywords": [ - "identity", - "providers", - "configuration", - "admin-guide", - "admin-guide/security/providers", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:security:roles", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Roles", - "section": "admin-guide", - "slug": "admin-guide/security/roles", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/security/roles.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/roles.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Roles"], - "summary": "Roles This section details how to configure the roles. Roles are groups of permissions that can be configured for authorizations. How to create a role 1. Log in to Horizon Administration Interface. 2. Access Roles from the drawer or card: S", - "content": "Roles\n\n This section details how to configure the roles. Roles are groups of permissions that can be configured for authorizations.\n\n How to create a role\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Roles from the drawer or card: Security   Access Management   Roles .\n\n 3. Click on .\n\n 4. Fill in at least the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful name.\n\n Description (string input) :\n\nEnter a description.\n\n 6. Configuration permissions\n\n 7. Lifecycle permissions\n\n 8. Discovery permissions\n\n 9. Click on the save button.\n\n You can get the list of members .\n\n You can update or delete the Role.\n\n Authorization\n Password Policies", - "keywords": [ - "roles", - "admin-guide", - "admin-guide/security/roles", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:security:teams", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Teams", - "section": "admin-guide", - "slug": "admin-guide/security/teams", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/security/teams.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/security/teams.html", - "breadcrumbs": ["Horizon", "Admin guide", "Security", "Teams"], - "summary": "Teams This section details how to configure teams. Teams are groups of horizon objects owner (certificates, requests) and does not define permissions. How to create a team 1. Log in to Horizon Administration Interface. 2. Access Teams from ", - "content": "Teams\n\n This section details how to configure teams. Teams are groups of horizon objects owner (certificates, requests) and does not define permissions.\n\n How to create a team\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Teams from the drawer or card: Security   Access Management   Teams .\n\n 3. Click on .\n\n 4. Fill at least the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful name.\n\n Description (string input) :\n\nEnter a description.\n\n Contact email (string input) :\n\nEnter a valid email.\n\n Manager email (string input) :\n\nEnter a valid email.\n\n Messaging tool (select) :\n\nSelect one of Webhook Messaging tools supported\n\n URL (string input) :\n\nEnter the webhook messaging URL for the team(used by Groupware notifications )\n\n 5. Click on the save button.\n\n You can get the list of members .\n\n You can update or delete the Team.\n\n Identity Providers Configuration\n Email", - "keywords": [ - "teams", - "admin-guide", - "admin-guide/security/teams", - "horizon", - "admin", - "guide", - "security" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:system:grading", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Grading Rules", - "section": "admin-guide", - "slug": "admin-guide/system/grading", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/system/grading.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/system/grading.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "System configuration", - "Grading Rules" - ], - "summary": "Grading Rules The grading rules feature enhances the governance capabilities of Horizon, clearly displaying the quality of a certificate using different criteria. Currently, there is only one grading policy which is the Horizon grading poli", - "content": "Grading Rules\n\n The grading rules feature enhances the governance capabilities of Horizon, clearly displaying the quality of a certificate using different criteria.\nCurrently, there is only one grading policy which is the Horizon grading policy designed by EverTrust experts using common reference documents.\n\n The grading mechanism works as following:\n\n Each rule is evaluated individually;\n\n The score of each ruleset is calculated by adding the scores of each of its rules and dividing it by the max note for each ruleset, giving a score \\(s_i \\in [-1,1]\\) for each ruleset;\n\n The effective score for the grading policy is calculated through a weighted sum: \\( S = \\sum_i w_i * s_i \\) with \\( w_i\\) being the weight of each ruleset;\n\n The sum of the weights is calculated: \\( W = \\sum_i w_i \\) ;\n\n The score of the certificate for this grading policy is then calculated by dividing S by W: \\(cert\\_score = \\frac{S}{W} \\in [-1,1]\\) , then the score is put back over 100 and the certificate grade is applied with the following scale:\n\n Breakdown of the grading rules\n\n ANSSI Cryptographic Content\n\n The ANSSI Cryptographic Content Ruleset is created from the good practices advocated by the French ANSSI to ensure good cryptographic material when dealing with X509 certificates (based on the RGS).\nThis ruleset has a maximum possible score of 70 and has a weight of 50 in the Horizon Grading Policy.\n\n Details\n\n Rule\n Score if satisfied\n Score if not satisfied\n\n Certificate Policy OID should be specified\n\n 10\n\n 0\n\n Certificate should contain at least a CRLDP or an AIA OCSP URL\n\n 10\n\n 0\n\n Certificate should contain the subject key identifier extension\n\n 10\n\n 0\n\n Certificate subject and issuer should differ and authority key identifier should be defined\n\n 10\n\n 0\n\n Certificate issuer should contain the country element ('C')\n\n 5\n\n 0\n\n Certificate issuer should contain the organization element ('O')\n\n 5\n\n 0\n\n Certificate issuer should contain the organizational unit element ('OU') or organisational identifier ('organizationIdentifier')\n\n 5\n\n 0\n\n Certificate subject should contain the country element ('C')\n\n 5\n\n 0\n\n Certificate subject should contain the organization element ('O')\n\n 5\n\n 0\n\n Certificate subject should contain the organizational unit element ('OU') or organisational identifier ('organizationIdentifier')\n\n 5\n\n 0\n\n CA/B Forum Ruleset\n\n The CA/B Forum Ruleset contains good practices for certificates from the CA/B Forum recommendations.\n\nThis ruleset has a maximum possible score of 40 and has a weight of 60 in the Horizon Grading Policy.\n\n Details\n\n Rule\n Score if satisfied\n Score if not satisfied\n\n CP OID extension is not empty\n\n 10\n\n 0\n\n Character '_' is forbidden in SAN DNS (penalty rule)\n\n 0\n\n -10\n\n SAN DNS field must not end with '.' (penalty rule)\n\n 0\n\n -10\n\n Certificate lifetime is less than 397 days\n\n 10\n\n 0\n\n Certificate serial number is longer than 8 bytes\n\n 10\n\n 0\n\n SAN DNS field is not empty\n\n 10\n\n 0\n\n Total\n\n 40\n\n -20\n\n NIST and ANSSI ECDSA Cryptographic Ruleset (Weight 100, Maximum score 35)\n\n The NIST and ANSSI ECDSA Cryptographic Ruleset contains good practices when dealing with elliptic curves cryptography for the certificate’s private key.\n\nThis ruleset has a maximum possible score of 35 and has a weight of 100 in the Horizon Grading Policy.\n\n Details\n\n Rule\n Score if satisfied\n Score if not satisfied\n\n EC key algorithm should be P-256, P-384 or P-521\n\n 25\n\n 0\n\n Signing hash algorithm should be SHA-256, SHA-384, SHA-512, SHA-3-256, SHA-3-384 or SHA-3-512\n\n 10\n\n 0\n\n Total\n\n 35\n\n 0\n\n EMail Certificate Ruleset\n\n The EMail Certificate Ruleset contains good practices written by the EverTrust experts regarding the use of S/MIME certificates.\n\nThis ruleset has a maximum possible score of 20 and has a weight of 60 in the Horizon Grading Policy.\n\n Details\n\n Rule\n Score if satisfied\n Score if not satisfied\n\n Certificate with extended key usages 'emailProtection' should contain any of the following key usages: 'digitalSignature', 'nonRepudiation', 'keyEncipherment', 'dataEncipherment'\n\n 10\n\n 0\n\n SAN Email (RFC822Name) field is not empty\n\n 10\n\n 0\n\n Total\n\n 20\n\n 0\n\n IETF PKIX Ruleset\n\n The IETF PKIX Ruleset contains good practices from the IETF PKIX recommendations.\n\nThis ruleset has a maximum possible score of 30 and has a weight of 100 in the Horizon Grading Policy.\n\n Details\n\n Rule\n Score if satisfied\n Score if not satisfied\n\n An entity certificate should not contain a pathlen\n\n 10\n\n 0\n\n Issuer must not be empty\n\n 5\n\n 0\n\n Subject must not be empty\n\n 5\n\n 0\n\n Subject key identifier extension should not be empty\n\n 5\n\n 0\n\n Certificate subject and issuer should differ and authority key identifier should be defined\n\n 5\n\n 0\n\n If defined, AIA OCSP URL should use HTTP (penalty rule)\n\n 0\n\n -10\n\n If defined, CRLDP should use LDAP or HTTP (penalty rule)\n\n 0\n\n -10\n\n Non-CA certificate cannot be self-signed (penalty rule)\n\n 0\n\n -30\n\n The certificate is issued by an untrusted CA (penalty rule)\n\n 0\n\n -15\n\n Certificate KeyUsage cannot be empty (penalty rule)\n\n 0\n\n -10\n\n Total\n\n 30\n\n -75\n\n NIST and ANSSI RSA Cryptographic Ruleset\n\n The NIST and ANSSI RSA Cryptographic Ruleset contains good practices when dealing with RSA cryptography for the certificate’s private key.\n\nThis ruleset has a maximum possible score of 35 and has a weight of 100 in the Horizon Grading Policy.\n\n Details\n\n Rule\n Score if satisfied\n Score if not satisfied\n\n RSA key size should be greater or equals to 2048 bits\n\n 10\n\n 0\n\n RSA key size should be greater or equals to 3072 bits\n\n 5\n\n 0\n\n RSA key exponent should be greater than 2^16\n\n 10\n\n 0\n\n Signing hash algorithm should be SHA-256, SHA-384, SHA-512, SHA-3-256, SHA-3-384 or SHA-3-512\n\n 10\n\n 0\n\n RSA key size should not be less than 2048 bits (penalty rule)\n\n 0\n\n -10\n\n RSA key size must not be less than 1024 bits (penalty rule)\n\n 0\n\n -10\n\n Total\n\n 35\n\n -20\n\n TLS Certificate Ruleset\n\n The TLS certificate ruleset contains good practices for certificates used to identify web servers.\n\nThis ruleset has a maximum possible score of 20 and has a weight of 60 in the Horizon Grading Policy.\n\n Details\n\n Rule\n Score if satisfied\n Score if not satisfied\n\n Certificate with extended key usages 'TLSServer' should contain key usage 'digitalSignature'\n\n 10\n\n 0\n\n Certificate with extended key usage 'TLSServer' should not have a subject containing the following elements: 'givenname', 'surname' (penalty rule)\n\n 0\n\n -5\n\n SAN DNS field is not empty\n\n 10\n\n 0\n\n Total\n\n 20\n\n -5\n\n Applying the grading policy\n\n All certificates that are in Horizon can be graded using grading policies, whether they are discovered or fully managed by the product.\nIf you want to add a grading policy to a profile, simply go to the profile settings then in the \"Common configuration for profile\" tab select the grading policies that will be used to grade certificates on this profile.\n\nTo remove a grading policy from a profile you just have to unselect it from the drop-down menu.\n\n You can also grade discovered certificates: in the Discovery menu, click on the campaign that you want to apply the grading policies on and then select the grading policies that you want to apply from the drop-down menu.\n\nAgain, to remove a grading policy from a discovery campaign, just unselect it from the same drop-down menu.\n\n Manually re-grading certificates\n\n In case anything went wrong in the initial grading of certificates, or if you manually added a new grading policy to an existing profile and you want to manually re-evaluate a grading policy, follow these steps:\n\n 1. Go to System   Grading Rules ;\n\n 2. Select the Grading Policy that you want to manually relaunch and click the .\n\n All certificates concerned by this grading policy will now be re-graded.\n\n HTTP Proxy\n Cron Expression", - "keywords": [ - "grading", - "rules", - "admin-guide", - "admin-guide/system/grading", - "horizon", - "admin", - "guide", - "system", - "configuration" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:system:http_proxies", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "HTTP Proxy", - "section": "admin-guide", - "slug": "admin-guide/system/http_proxies", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/system/http_proxies.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/system/http_proxies.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "System configuration", - "HTTP Proxy" - ], - "summary": "HTTP Proxy In this section you will be able to set up HTTP Proxies. HTTP Proxies may be used by Horizon to establish connection to various services. How to configure an HTTP Proxy 1. Log in to Horizon Administration Interface. 2. Access HTT", - "content": "HTTP Proxy\n\n In this section you will be able to set up HTTP Proxies. HTTP Proxies may be used by Horizon to establish connection to various services.\n\n How to configure an HTTP Proxy\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access HTTP Proxy from the drawer or card: System   HTTP Proxies .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful HTTP Proxy name.\n\n Host * (string input) :\n\nThe Hostname or IP Address of the HTTP/HTTPS proxy to use.\n\n Port * (int) :\n\nThe Port of the HTTP/HTTPS proxy to use.\n\n 5. Click on the create button to save.\n\n You can update or delete the HTTP Proxy.\n\n You won’t be able to delete an HTTP Proxy if it is referenced in any other configuration element.\n\n Labels\n Grading Rules", - "keywords": [ - "http", - "proxy", - "admin-guide", - "admin-guide/system/http_proxies", - "horizon", - "admin", - "guide", - "system", - "configuration" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:system:labels", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Labels", - "section": "admin-guide", - "slug": "admin-guide/system/labels", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/system/labels.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/system/labels.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "System configuration", - "Labels" - ], - "summary": "Labels This section details how to configure the labels. Labels are metadata used to store information provided by the en-users in Horizon database, associated to a given certificate, but not contained in the certificate. You will be able t", - "content": "Labels\n\n This section details how to configure the labels. Labels are metadata used to store information provided by the en-users in Horizon database, associated to a given certificate, but not contained in the certificate.\n\n You will be able to associate the labels created in this section with your profiles in order to enrich the certificates that will be issued from them.\n\n How to configure a Label\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Labels from the drawer or card: System   Labels .\n\n 3. Click on .\n\n 4. Fill the following fields:\n\n Name * (string input) :\n\nEnter a meaningful Label name.\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of the label.\n\n Description (string input) :\n\nEnter a description. This will be displayed when making a request with this label and when adding it to a profile.\n\n You can delete the localization.\n\n 5. Click on the create button to save.\n\n You can update or delete Labels.\n\n You won’t be able to delete a Label if it is referenced in any other configuration element.\n\n SCEP Authorities\n HTTP Proxy", - "keywords": [ - "labels", - "admin-guide", - "admin-guide/system/labels", - "horizon", - "admin", - "guide", - "system", - "configuration" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:system:scep_authorities", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "SCEP Authorities", - "section": "admin-guide", - "slug": "admin-guide/system/scep_authorities", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/system/scep_authorities.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.5/admin-guide/system/scep_authorities.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "System configuration", - "SCEP Authorities" - ], - "summary": "SCEP Authorities This section details how to configure SCEP Authorities. The draft-nourse-scep-23 as well as RFC 8894 define how SCEP communications are secured. This involves using a SCEP Authority, which is a certificate and its associate", - "content": "SCEP Authorities\n\n This section details how to configure SCEP Authorities.\n\n The draft-nourse-scep-23 as well as RFC 8894 define how SCEP communications are secured. This involves using a SCEP Authority, which is a certificate and its associated private key, used to sign and encrypt communications between SCEP server and client.\n\n Two setups are possible:\n\n the CA mode in which the SCEP Authority is a self-signed certificate. In that mode the SCEP server returns the self-signed certificate as application/x-x509-ca-cert when the client uses the GetCaCert call.\n\n the RA mode in which the SCEP Authority is a certificate signed by the CA that will issue certificates using the considered SCEP profile. In that mode, the SCEP server returns the SCEP Authority certificate and its issuing CA chain as application/x-x509-ca-ra-cert when the client uses the GetCaCert call.\n\n Therefore, it is important in each SCEP or MDM Profile to align the SCEP mode with the characteristics of the SCEP Authority configured in the current section.\n\n Prerequisites\n\n PKCS#12 containing the SCEP Authority certificate and private key. See above for explanation about the SCEP contents.\n\n How to configure a SCEP Authority\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access SCEP Authorities from the drawer or card: System   SCEP Authorities .\n\n 3. Click on .\n\n 4. Fill the following fields:\n\n Name * (string input) :\n\nEnter a meaningful SCEP Authority name;\n\n PKCS#12 * (import p12) :\n\nPKCS#12 of the SCEP Authority;\n\n PKCS#12 Password * (string input) :\n\nPassword of the aforementioned PKCS#12.\n\n 5. Click on the create button to save.\n\n You can update or delete the SCEP Authority.\n\n You won’t be able to delete a SCEP Authority if it is referenced in any other configuration element.\n\n Jamf Scheduled Tasks\n Labels", - "keywords": [ - "scep", - "authorities", - "admin-guide", - "admin-guide/system/scep_authorities", - "horizon", - "admin", - "guide", - "system", - "configuration" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:akv:connector", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Azure AKV Connector", - "section": "admin-guide", - "slug": "admin-guide/third-parties/akv/connector", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/akv/connector.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/akv/connector.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "AKV", - "Azure AKV Connector" - ], - "summary": "Azure AKV Connector Here is the section to manage the Azure AKV Connector. Required By Azure AKV Trigger Prerequisites On Horizon side, you might need to set up a Proxy used to reach Azure, if necessary. On Azure AD side, it is required to ", - "content": "Azure AKV Connector\n\n Here is the section to manage the Azure AKV Connector.\n\n Required By\n\n Azure AKV Trigger\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy used to reach Azure, if necessary.\n\n On Azure AD side, it is required to set up an application by following Microsoft’s guide .\n\nHorizon supports only client secret authentication\n\n After performing these steps, you will get the following information, required later:\n\n the Tenant ID\n\n the Application ID\n\n the Application Authentication Key\n\n Finally, you should give all Certificate Permissions to the Application you created for Horizon inside the target Azure Key Vault \"Access policies\" menu entry, using the \"Add Access Policy\" link.\n\n How to configure AKV Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AKV Connectors from the drawer or card: Third Parties   AKV   Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful Connector Name.\n\n Azure Tenant * (string input) :\n\nEnter the Tenant, which is the domain name after the @ sign in your account.\n\n App ID * (string input) :\n\nEnter the app ID.\n\n App Key * (string input) :\n\nEnter the app Key.\n\n Proxy (string select) :\n\nThe HTTP/HTTPS proxy used to reach Azure AD and AKV, if necessary.\n\n Timeout ( finite duration ) :\n\nSet on the connections used to reach Azure AD and AKV. Configured by default at 10 seconds. Must be a valid finite duration.\n\n Vault fully qualified domain name * (string input) :\n\nFully qualified domain name used to reach the Azure Key Vault to be managed by Horizon.\n\n Assets identification and management\n\n Prefix (string input) : Used to filter the certificates managed by Horizon in the specified Azure Key Vault. Defaults to \"HRZ-\"\n\n Actors and renewal management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default at 3.\n\n Renewal period ( finite duration ) :\n\nMust be a valid finite duration.\n\n 5. Click on the save button.\n\n You can update or delete the AKV Connector.\n\n You will not be able to delete an AKV Connector if it is referenced in any other configuration element.\n\n Synchronize your third party\n\n Your third-party certificates can be synchronized with Horizon using scheduled tasks.\n\n Scheduled tasks are a functionality of WebRA that allows to synchronize automatic renewal or revocation events with a third party periodically with what occurs on a WebRA profile.\nTo be more specific, it will periodically check whether the certificate has entered the \"renewal period\" that was defined in the connector’s configuration, and renew it automatically if necessary.\n\n 1. Refer to the third party connector documentation to create a third party connector.\n\n 2. Ensure you have an existing WebRA Profile : renewal will be automated on the selected profile.\n\n 3. Follow the documentation of the WebRA Scheduled Tasks section to properly configure a scheduled task.\n\n AKV Introduction\n AKV Trigger", - "keywords": [ - "azure", - "akv", - "connector", - "admin-guide", - "admin-guide/third-parties/akv/connector", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:akv:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "AKV Introduction", - "section": "admin-guide", - "slug": "admin-guide/third-parties/akv/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/akv/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/akv/introduction.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "AKV", - "AKV Introduction" - ], - "summary": "AKV Introduction This section refers to the Azure Key Vault (AKV) integration with Horizon, used to enroll certificates held in AKV. This integration involves at least three infrastructure components: Azure Key Vault Azure Active Directory ", - "content": "AKV Introduction\n\n This section refers to the Azure Key Vault (AKV) integration with Horizon, used to enroll certificates held in AKV.\n\n This integration involves at least three infrastructure components:\n\n Azure Key Vault\n\n Azure Active Directory\n\n EverTrust Horizon\n\n Azure AD is used to authenticate Horizon, which should be a registered application.\n\n AWS Trigger\n Azure AKV Connector", - "keywords": [ - "akv", - "introduction", - "admin-guide", - "admin-guide/third-parties/akv/introduction", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:akv:triggers", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "AKV Trigger", - "section": "admin-guide", - "slug": "admin-guide/third-parties/akv/triggers", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/akv/triggers.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/akv/triggers.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "AKV", - "AKV Trigger" - ], - "summary": "AKV Trigger This section details how to configure the Triggers that will be used by Profiles to push or delete certificates to/from AKV. Prerequisites Azure AKV Connector How to configure AKV Trigger 1. Log in to Horizon Administration Inte", - "content": "AKV Trigger\n\n This section details how to configure the Triggers that will be used by Profiles to push or delete certificates to/from AKV.\n\n Prerequisites\n\n Azure AKV Connector\n\n How to configure AKV Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AKV Triggers from the drawer or card: Third Parties   AKV   Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n Azure Key Vault Connector * (select) :\n\nSelect an AKV connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the AKV repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the AKV Trigger.\n\n Synchronization using triggers\n\n Triggers are a functionality of WebRA , Intune PKCS , WCCE and CRMP profiles that allows to push lifecycle events into a third party whenever they occur on a profile.\n\n 1. Refer to the trigger documentation to create a trigger.\n\n 2. Create or modify the profile you wish to use the triggers on.\n\n 3. Go to the Triggers tab, then on Certificate lifecycle triggers\n\n 4. Chose which lifecycle events you wish to use triggers upon (enrollment, revocation, expiration)\n\n 5. Select one or more existing triggers from the menu (if several are selected, they will all be called whenever the selected event occurs)\n\n 6. Click on the Save button.\n\n From now on, whenever a selected lifecycle event will occur on the configured profile, the trigger will be called and the and the certificate will be pushed into or removed from the third party container.\n\n Azure AKV Connector\n F5 Introduction", - "keywords": [ - "akv", - "trigger", - "admin-guide", - "admin-guide/third-parties/akv/triggers", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:aws:connector", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "AWS Connector", - "section": "admin-guide", - "slug": "admin-guide/third-parties/aws/connector", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/aws/connector.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/aws/connector.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "AWS", - "AWS Connector" - ], - "summary": "AWS Connector Here is the section to manage the AWS Connector. Required By AWS Trigger Prerequisites On Horizon side, you might need to set up a Proxy , used to reach AWS, if necessary. On AWS side, you need to create a user using the AWS I", - "content": "AWS Connector\n\n Here is the section to manage the AWS Connector.\n\n Required By\n\n AWS Trigger\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy , used to reach AWS, if necessary.\n\n On AWS side, you need to create a user using the AWS IAM module, and following AWS guide . You should create an access key for that user, and give him appropriate permissions. The created user should hold the following permissions:\n\n AWSResourceGroupsReadOnlyAccess\n\n ResourceGroupsandTagEditorReadOnlyAccess\n\n AWSCertificateManagerFullAccess\n\n After performing these steps, you will get the following information, required later:\n\n the AWS Region\n\n the User Access Key ID\n\n the User Access Key Secret\n\n On top of that, you need to define a Resource Group, using AWS Resource Groups and Tags Editor, with the following characteristics:\n\n Group Type: Tag based\n\n Resource Type: AWS::CertificateManager::Certificate\n\n Tag key and value (e.g. key=manage and value=HRZ)\n\n After performing this steps, you will get the following information, required later:\n\n The Resource Group name\n\n the Tag name\n\n the Tag value\n\n How to configure AWS Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AWS Connectors from the drawer or card: Third Parties   AWS   Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Region * (string input) :\n\nEnter a valid AWS region. Here’s the region list from AWS.\n\n Access key ID (string input) :\n\nUser Access Key ID used by Horizon to connect to AWS.\n\n Access Key Secret (string input) :\n\nAccess Key Secret associated to the aforementioned User Access Key ID.\n\n Proxy (string select) :\n\nThe HTTP/HTTPS proxy to use to reach AWS, if any.\n\n Timeout * ( finite duration ) :\n\nThe timeout for Horizon-initiated connections to AWS. Must be a valid finite duration.\n\n Assets identification\n\n Resource group name (string input) :\n\nName of the resource group pointing to the tag name and value.\n\n Role ARN (string input) :\n\nName of the AWS role Horizon will impersonate in ACM.\n\n Tag key (string input) :\n\nName of the tag used to identify certificates managed by Horizon in ACM.\n\n Tag value (string input) :\n\nValue of the tag used to identify certificates managed by Horizon in ACM.\n\n Actors and renewal management\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be a valid finite duration.\n\n Renewal period ( finite duration ) :\n\nCertificate renewal period (time before expiration to trigger renewal). Must be a valid finite duration.\n\n 5. Click on the save button.\n\n You can update or delete the AWS Connector.\n\n You won’t be able to delete an AWS Connector if it is referenced somewhere else.\n\n Synchronize your third party\n\n Your third-party certificates can be synchronized with Horizon using scheduled tasks.\n\n Scheduled tasks are a functionality of WebRA that allows to synchronize automatic renewal or revocation events with a third party periodically with what occurs on a WebRA profile.\nTo be more specific, it will periodically check whether the certificate has entered the \"renewal period\" that was defined in the connector’s configuration, and renew it automatically if necessary.\n\n 1. Refer to the third party connector documentation to create a third party connector.\n\n 2. Ensure you have an existing WebRA Profile : renewal will be automated on the selected profile.\n\n 3. Follow the documentation of the WebRA Scheduled Tasks section to properly configure a scheduled task.\n\n AWS Introduction\n AWS Trigger", - "keywords": [ - "aws", - "connector", - "admin-guide", - "admin-guide/third-parties/aws/connector", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:aws:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "AWS Introduction", - "section": "admin-guide", - "slug": "admin-guide/third-parties/aws/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/aws/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/aws/introduction.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "AWS", - "AWS Introduction" - ], - "summary": "AWS Introduction This section refers to the AWS Certificate Manager (ACM) integration with Horizon, used to enroll certificates held in ACM. This integration involves at least two infrastructure components: AWS Certificate Manager EverTrust", - "content": "AWS Introduction\n\n This section refers to the AWS Certificate Manager (ACM) integration with Horizon, used to enroll certificates held in ACM.\n\n This integration involves at least two infrastructure components:\n\n AWS Certificate Manager\n\n EverTrust Horizon\n\n WebRA Scheduled Tasks\n AWS Connector", - "keywords": [ - "aws", - "introduction", - "admin-guide", - "admin-guide/third-parties/aws/introduction", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:aws:triggers", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "AWS Trigger", - "section": "admin-guide", - "slug": "admin-guide/third-parties/aws/triggers", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/aws/triggers.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/aws/triggers.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "AWS", - "AWS Trigger" - ], - "summary": "AWS Trigger Here is the section to manage the Triggers that will be used by Profiles to push or delete certificates to/from AWS ACM. Prerequisites AWS Connector How to configure AWS Trigger 1. Log in to Horizon Administration Interface. 2. ", - "content": "AWS Trigger\n\n Here is the section to manage the Triggers that will be used by Profiles to push or delete certificates to/from AWS ACM.\n\n Prerequisites\n\n AWS Connector\n\n How to configure AWS Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access AWS Triggers from the drawer or card: Third Parties   AWS   Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n AWS Connector * (select) :\n\nSelect an AWS connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the AWS repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the AWS Trigger.\n\n You won’t be able to delete an AWS Trigger if it is referenced somewhere else.\n\n Synchronization using triggers\n\n Triggers are a functionality of WebRA , Intune PKCS , WCCE and CRMP profiles that allows to push lifecycle events into a third party whenever they occur on a profile.\n\n 1. Refer to the trigger documentation to create a trigger.\n\n 2. Create or modify the profile you wish to use the triggers on.\n\n 3. Go to the Triggers tab, then on Certificate lifecycle triggers\n\n 4. Chose which lifecycle events you wish to use triggers upon (enrollment, revocation, expiration)\n\n 5. Select one or more existing triggers from the menu (if several are selected, they will all be called whenever the selected event occurs)\n\n 6. Click on the Save button.\n\n From now on, whenever a selected lifecycle event will occur on the configured profile, the trigger will be called and the and the certificate will be pushed into or removed from the third party container.\n\n AWS Connector\n AKV Introduction", - "keywords": [ - "aws", - "trigger", - "admin-guide", - "admin-guide/third-parties/aws/triggers", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:f5:connector", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "F5 Connector", - "section": "admin-guide", - "slug": "admin-guide/third-parties/f5/connector", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/f5/connector.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/f5/connector.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "F5", - "F5 Connector" - ], - "summary": "F5 Connector This section details how to configure the F5 Connector. Required By F5 Trigger Prerequisites On the F5 BigIP side, you need to create a technical user for Horizon, and give it full administrator rights. This is required because", - "content": "F5 Connector\n\n This section details how to configure the F5 Connector.\n\n Required By\n\n F5 Trigger\n\n Prerequisites\n\n On the F5 BigIP side, you need to create a technical user for Horizon, and give it full administrator rights. This is required because only full admins have the right to upload certificates on an F5 BigIP.\n\n After performing these steps, you will get the following information, required later:\n\n the technical user login/username\n\n the technical user password\n\n How to configure F5 Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access F5 Connectors from the drawer or card: Third Parties   F5   Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n F5 BigIP hostname * (string input) :\n\nEnter the F5 BigIP hostname (DNS or IP address).\n\n F5 BigIP username * (string input) :\n\nUsername created for Horizon in the F5 BigIP. Must have administrator rights.\n\n F5 BigIP password * (string input) :\n\nPassword associated with aforementioned username.\n\n Proxy (string select) :\n\nThe HTTP/HTTPS proxy to use.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be a valid finite duration.\n\n Max stored certificates per holder (int) :\n\nWhen specified, define the maximum number of certificates stored in the third party for a given holder.\n\n Assets identification\n\n Partition (string input) :\n\nF5 BigIP partition to manage. Common by default.\n\n SSL parent (string input) :\n\nName of the parent Client SSL Profile. Common by default.\n\n Prefix (string input) :\n\nUsed to filter the certificates managed by Horizon in the specified F5 Client. hrz- by default.\n\n Cipher group (string input) :\n\nName of the Cipher group. None by default.\n\n Actors and renewal management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default at 3.\n\n Renewal period * ( finite duration ) :\n\nMust be a valid finite duration.\n\n 5. Click on the save button.\n\n You can update or delete the F5 Connector.\n\n You will not be able to delete an F5 Connector if it is referenced in any other configuration element.\n\n Synchronize your third party\n\n Your third-party certificates can be synchronized with Horizon using scheduled tasks.\n\n Scheduled tasks are a functionality of WebRA that allows to synchronize automatic renewal or revocation events with a third party periodically with what occurs on a WebRA profile.\nTo be more specific, it will periodically check whether the certificate has entered the \"renewal period\" that was defined in the connector’s configuration, and renew it automatically if necessary.\n\n 1. Refer to the third party connector documentation to create a third party connector.\n\n 2. Ensure you have an existing WebRA Profile : renewal will be automated on the selected profile.\n\n 3. Follow the documentation of the WebRA Scheduled Tasks section to properly configure a scheduled task.\n\n F5 Introduction\n F5 Trigger", - "keywords": [ - "f5", - "connector", - "admin-guide", - "admin-guide/third-parties/f5/connector", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:f5:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "F5 Introduction", - "section": "admin-guide", - "slug": "admin-guide/third-parties/f5/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/f5/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/f5/introduction.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "F5", - "F5 Introduction" - ], - "summary": "F5 Introduction This section refers to the F5 BigIP integration with Horizon, used to enroll certificates used by F5 BigIP. This integration involves at least two infrastructure components: F5 BigIP EverTrust Horizon Horizon connects to the", - "content": "F5 Introduction\n\n This section refers to the F5 BigIP integration with Horizon, used to enroll certificates used by F5 BigIP.\n\n This integration involves at least two infrastructure components:\n\n F5 BigIP\n\n EverTrust Horizon\n\n Horizon connects to the F5 BigIP using the iControl REST administration API in order to manage the lifecycle of certificates associated to Client SSL Profiles within the BigIP.\n\n AKV Trigger\n F5 Connector", - "keywords": [ - "f5", - "introduction", - "admin-guide", - "admin-guide/third-parties/f5/introduction", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:f5:triggers", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "F5 Trigger", - "section": "admin-guide", - "slug": "admin-guide/third-parties/f5/triggers", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/f5/triggers.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/f5/triggers.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "F5", - "F5 Trigger" - ], - "summary": "F5 Trigger This section details how to configure the Triggers that will be used by Profiles to push or delete certificates to/from F5 BigIP. Prerequisites F5 Connector How to configure F5 Trigger 1. Log in to Horizon Administration Interfac", - "content": "F5 Trigger\n\n This section details how to configure the Triggers that will be used by Profiles to push or delete certificates to/from F5 BigIP.\n\n Prerequisites\n\n F5 Connector\n\n How to configure F5 Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access F5 Triggers from the drawer or card: Third Parties   F5   Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon use the name to identify the trigger.\n\n F5 Connector * (select) :\n\nSelect a connector F5 previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the F5 BigIP repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the F5 Trigger.\n\n Synchronization using triggers\n\n Triggers are a functionality of WebRA , Intune PKCS , WCCE and CRMP profiles that allows to push lifecycle events into a third party whenever they occur on a profile.\n\n 1. Refer to the trigger documentation to create a trigger.\n\n 2. Create or modify the profile you wish to use the triggers on.\n\n 3. Go to the Triggers tab, then on Certificate lifecycle triggers\n\n 4. Chose which lifecycle events you wish to use triggers upon (enrollment, revocation, expiration)\n\n 5. Select one or more existing triggers from the menu (if several are selected, they will all be called whenever the selected event occurs)\n\n 6. Click on the Save button.\n\n From now on, whenever a selected lifecycle event will occur on the configured profile, the trigger will be called and the and the certificate will be pushed into or removed from the third party container.\n\n F5 Connector\n LDAP Introduction", - "keywords": [ - "f5", - "trigger", - "admin-guide", - "admin-guide/third-parties/f5/triggers", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:intune_pkcs:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Intune PKCS Introduction", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune_pkcs/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/intune_pkcs/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/intune_pkcs/introduction.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Intune PKCS", - "Intune PKCS Introduction" - ], - "summary": "Intune PKCS Introduction This integration involves at least three infrastructure components: Microsoft Endpoint Manager / Intune Azure Active Directory EverTrust Horizon The enrolled devices interface with these components in order to retri", - "content": "Intune PKCS Introduction\n\n This integration involves at least three infrastructure components:\n\n Microsoft Endpoint Manager / Intune\n\n Azure Active Directory\n\n EverTrust Horizon\n\n The enrolled devices interface with these components in order to retrieve their certificate.\n\n The diagram displays these components as well as the various flows involved in an enrollment.\nThe integration is further explained in the Microsoft Intune PKCS documentation .\n\n Intune Scheduled Tasks\n Intune PKCS Connector", - "keywords": [ - "intune", - "pkcs", - "introduction", - "admin-guide", - "admin-guide/third-parties/intune_pkcs/introduction", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:intune_pkcs:intune_pkcs_connector", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Intune PKCS Connector", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune_pkcs/intune_pkcs_connector", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/intune_pkcs/intune_pkcs_connector.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/intune_pkcs/intune_pkcs_connector.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Intune PKCS", - "Intune PKCS Connector" - ], - "summary": "Intune PKCS Connector This section details how to configure the Intune PKCS Connector. Required By Intune PKCS Profile How to configure Intune PKCS Connector Configuring the Microsoft Certificate Connector The first step of the Intune PKCS ", - "content": "Intune PKCS Connector\n\n This section details how to configure the Intune PKCS Connector.\n\n Required By\n\n Intune PKCS Profile\n\n How to configure Intune PKCS Connector\n\n Configuring the Microsoft Certificate Connector\n\n The first step of the Intune PKCS connector is to actually understand the workflow that it bears, explained in introduction.\nWorking with IntunePKCS requires the Microsoft Certificate Connector MSI to be uploaded to any Windows machine connected to the Internet.\nThis connector is available on the Microsoft Documentation .\n\n 1. Run the certificate connector MSI on the machine and click on \"Configure now\". Configure the connector to fit your infrastructure, just remember to only check the PKCS imported box whenever prompted.\nThis step should end with a connection to Azure;\n\n 2. Retrieve the Horizon Key Manager from Horizon and upload it to the same machine where the Microsoft Certificate Connector was installed;\n\n 3. Open a command-line prompt as Administrator;\n\n 4. Generate an import key through the command-line tool:\n\n $ PKCSImport.exe generate [KeyName]\n\n Replace [KeyName] with what you want to name your key as. The next steps of the documentation will assume that the name is set to \"PKCSImportKey\".\n\n 5. Use the tool to export the generated key:\n\n $ PKCSImport.exe export PKCSImportKey PKCSImportKey.pub\n\n This will export the public key part of the PKCS Import Key to the PKCSImportKey.pub file as base64 format.\n\n Configuring the IntunePKCS Connector in Horizon\n\n This step assumes that the previous one has been thoroughly followed. The only extra pre-requisite for this step is to retrieve the Azure resource ID of the group that will be using the escrowed certificates.\nNote that the app registration for Horizon must have the \" DeviceManagementConfiguration.ReadWrite.All \" permission granted as tenant admin. Read more about that in the Microsoft documentation\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Connectors from the drawer or card: Third Parties   Intune PKCS   Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Azure Tenant * (string input) :\n\nValue must be set to the Azure tenant.\n\n App ID * (string input) :\n\nValue must be set to the app registration ID that was created for Horizon.\nThe app registration must have the \" DeviceManagementConfiguration.ReadWrite.All \" permission granted as tenant admin.\n\n App Key * (string input) :\n\nValue must be set to the app secret key that was created for the aforementioned app registration.\n\n Proxy (string select) :\n\nThe HTTP/HTTPS proxy to use.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be a valid finite duration.\n\n Search Filter (string input) :\n\nThis value must be set to : groups/{Azure AD group object ID}/members\nThis will apply the PKCS Import policy to all the members of the referenced Azure AD group object ID (the one that was retrieved at the beginning of the step).\n\n Max stored certificates per holder (int) :\n\nWhen specified, define the maximum number of certificates stored in the third party for a given holder.\nAs an example, when set to 2, Intune will store the current certificate as well as the previous one (whether expired or revoked), so that it can still be used to decrypt resources.\nWhen a third one is going to be enrolled, the older one will be flushed out of Intune.\n\n Assets identification and management\n\n Key Name (string input) :\n\nEnter the key name that was specified in the Horizon Key Manager ( PKCSImportKey in the example).\n\n Key Type (select) :\n\nSelect one key type from the list. If the Horizon Key Manager was used, select RSA-2048 .\n\n Provider Name (string input) :\n\nEnter provider name. If the Horizon Key Manager was used, leave it blank.\n\n Public Key (string input) :\n\nPaste the base64 exported public key generated at step 5 of the previous part.\n\n Intended Purpose (select) :\n\nSelect one intended certificate usage from the list. As an example, if you want to use the escrowed certificates through this connector to encrypt email, select S/MIME.\n\n Actors and renewal management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default at 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default at 3.\n\n Renewal period ( finite duration ) :\n\nMust be a valid finite duration.\n\n 5. Click on the save button.\n\n You can update or delete the Intune PKCS Connector.\n\n You won’t be able to delete an Intune PKCS Connector if it is referenced in any other configuration element.\n\n Intune PKCS Introduction\n Intune PKCS Profile", - "keywords": [ - "intune", - "pkcs", - "connector", - "admin-guide", - "admin-guide/third-parties/intune_pkcs/intune_pkcs_connector", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:intune_pkcs:intune_pkcs_profile", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Intune PKCS Profile", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune_pkcs/intune_pkcs_profile", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/intune_pkcs/intune_pkcs_profile.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/intune_pkcs/intune_pkcs_profile.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Intune PKCS", - "Intune PKCS Profile" - ], - "summary": "Intune PKCS Profile This section details how to configure the Intune PKCS Profile Required By Intune PKCS Scheduled Tasks Prerequisites PKI Connector How to configure Intune PKCS Profile 1. Log in to Horizon Administration Interface. 2. Acc", - "content": "Intune PKCS Profile\n\n This section details how to configure the Intune PKCS Profile\n\n Required By\n\n Intune PKCS Scheduled Tasks\n\n Prerequisites\n\n PKI Connector\n\n How to configure Intune PKCS Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Profiles from the drawer or card: Third Parties   Intune PKCS   Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Intune PKCS Profile Specific Configuration\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each profile. Horizon uses the name to identify the profile.\n\n Enable * (boolean) :\n\nIs the profile enabled or not. Set at true by default.\n\n PKI Connector (string select) :\n\nSelect a PKI connector previously created.\nCAUTION: The selected PKI connector must support the msUPN SAN and, if used for S/MIME encryption, the RFC822NAME SAN (email).\n\n Intune PKCS Connector * (select) :\n\nSelect an Intune PKCS Connector previously created.\n\n Crypto Policy\n\n Default Key Type (select) :\n\nSelect the default type of key to generate when using centralized enrollment mode.\n\n Authorized Key Types (multiselect) :\n\nKey Types that can be used for enrollment. An empty value means no restrictions.\n\n Private key escrowing (boolean) :\n\nTells whether the private key should be escrowed by Horizon.\nThe default value is set to false.\n\n Show PKCS#12 Password On Recover (boolean) :\n\nTells whether the PKCS#12 password should be displayed on recover.\nThe default value is set to false.\n\n Show PKCS#12 On Recover (boolean) :\n\nTells whether the PKCS#12 should be displayed on recover.\nThe default value is set to false.\n\n PKCS#12 Password Mode * (select) :\n\nSelect how to generate PKCS#12 password:\n\n manual : prompt the user to choose its password. This is the default behavior.\n\n random : have the password generated on Horizon side.\n\n Password policy (select) :\n\nSelect a previously created password policy. It will be enforced on PKCS#12 password for recovery and centralized enrollments.\n\n Store encryption type * (select) :\n\nSelect an encryption algorithm from the list. The PKCS#12 will use this algorithm.\nThe default value is set to DES_AVERAGE.\n\n Max Certificate per Holder Policy\n\n Maximum (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Behavior (select) :\n\nWhat behavior to have when the maximum number is reached:\n\n revoke the previous certificates.\n\n reject the current request.\n\n Revocation reason (select) :\n\nWhen the revoke behavior is selected, the revocation reason to revoke the certificate with.\n\n Common configuration for profiles\n\n Languages\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of this profile.\n\n Description (string input) :\n\nEnter a description. This will be displayed on the list view of the profiles.\n\n You can delete the localization.\n\n Grading Policies\n\n You can select grading policies that will grade your certificate for a quick overview of its quality.\nFor more information about the inner working of the grading policies in Horizon, please refer to the grading rules page .\n\n Workflows builder\n\n Configure custom rights for actions on this profile.\n\n 1. Select an authorization level for each workflow.\n\n Everyone :\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live\n\n Configure the time your requests have before expiring.\n\nAfter expiration, requests are stored for an additional 30 days. This can be changed using configuration files .\n\n Enrollment request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Renewal request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Revocation request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Update request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Migration request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Recover request ( finite duration ) :\n\n Enabled on escrow : Must be a valid finite duration. The default value is set to seven days.\n\n Self Permissions\n\n These permissions apply to the owners of a certificate (team or owner). An owner can always request the following actions, but this permission allows them to perform the action without validation.\n\n Revoke (boolean) :\n\nGrant self revoke permission. The default value is set to false.\n\n Recover (boolean) :\n\nGrant self recover permission. The default value is set to false.\n\n Update (boolean) :\n\nGrant self update permission. The default value is set to false.\n\n Constraints\n\n Allowed email domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\nThis matches the domain of the email, not including anything before @ .\n\n Allowed DNS domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n CSR Data Mapping\n\n 1. Click on to add a mapping.\n\n 2. Select a field and enter a value.\n\n You can delete the CSR Data Mapping.\n\n Certificate Metadata\n\n This section details how to define a custom structure for the labels, ownership policy and technical metadata, allowing certificates to hold rich information.\n\n Labels\n\n You can add more labels by clicking .\n\n Name (select) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nShould the label be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Open the popup, enter the label value and press \"enter\" to add this value to the accepted value list. An empty whitelist means no restriction.\n\n Suggestions (string input multiple) :\n\nAdd suggestions that will be displayed to the user. The user will be able to choose one of these values or enter its own. Open the popup, enter your suggestions and press enter to add this value to the suggestions. An empty suggestions list means no restriction.\n\n Regex ( regex ) :\n\nThe label value will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this label to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can delete or reorder (drag and drop) the label template.\n\n Ownership policy\n\n Owner\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s owner is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the owner to the value of the evaluated computation rule . This value will override any other value including the user input.\n\n Contact email\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s contact email is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when approving a request.\n\n Default contact email (string input) :\n\nSet a default contact email. This value must comply with the contact email restriction.\n\n Contact email restriction\n\n Whitelist (string input multiple) :\n\nThe contact email will have to be in the whitelist. Open the popup, enter the email and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe contact email will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the contact email to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Team\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s team is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe team will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the team to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Metadata policy (overridable metadata)\n\nThese metadata are technical metadata. They are used by Horizon or Third party connectors, updating them should be done with utmost care.\n\nMetadata edition is not allowed on enroll.\n\nMetadata edition is not available via the User Interface. It must be changed with API, using horizon-cli.\n\n You can allow the override of technical metadata by clicking .\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n You can delete a metadata policy. This will not delete the metadata but will make it non editable.\n\n Notifications/Triggers\n\n This section details how to configure notifications and triggers to perform actions on certificate and request lifecycle events.\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n Renew\n\n Select a preexisting email or groupware notification to associate it with an event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by an Enroll/Revocation/Update/Migrate/Renew request:\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n Select a preexisting email or groupware notification to associate it with an event.\n\nSubmit request events are not triggered when the user has the permission to perform the action directly.\n\n Triggers\n\n Horizon support the use of third-party triggers in the form of callbacks on specific events happening on the profile, giving a way to synchronize the third party repositories and Horizon.\n\n Enrollment (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate is enrolled on this profile.\n\n Renewal (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate is renewed on this profile.\n\n Revocation (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate gets revoked on this profile.\n\n Expire (select) :\n\nSelect the preexisting third party or MDM trigger(s) to call whenever a certificate expires on this profile.\n\n The available triggers are the following:\n\n AKV Trigger\n\n AWS Trigger\n\n F5 Trigger\n\n LDAP Triggers\n\n On WebRA and Intune PKCS only: Intune PKCS Trigger\n\n 5. Click on the save button.\n\n You can update or delete the Intune PKCS Profile.\n\n You won’t be able to delete an Intune PKCS Profile if it is referenced in any other configuration element.\n\n Intune PKCS Connector\n Intune PKCS Scheduled Tasks", - "keywords": [ - "intune", - "pkcs", - "profile", - "admin-guide", - "admin-guide/third-parties/intune_pkcs/intune_pkcs_profile", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:intune_pkcs:intune_pkcs_scheduled_tasks", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Intune PKCS Scheduled Tasks", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune_pkcs/intune_pkcs_scheduled_tasks", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/intune_pkcs/intune_pkcs_scheduled_tasks.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/intune_pkcs/intune_pkcs_scheduled_tasks.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Intune PKCS", - "Intune PKCS Scheduled Tasks" - ], - "summary": "Intune PKCS Scheduled Tasks This section details how to schedule tasks that will run periodically on your Intune PKCS profiles. Prerequisites Intune PKCS Connector Intune PKCS Profile How to configure Intune PKCS Scheduled Tasks 1. Log in t", - "content": "Intune PKCS Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically on your Intune PKCS profiles.\n\n Prerequisites\n\n Intune PKCS Connector\n\n Intune PKCS Profile\n\n How to configure Intune PKCS Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Scheduled Tasks from the drawer or card: Third Parties   Intune PKCS   Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Enable (boolean) :\n\nTells whether the Scheduled task should be enabled. Set by default at true.\n\n Intune PKCS Profile * (select) :\n\nSelect an Intune PKCS profile previously created.\n\n Target Connector * (select) :\n\nSelect an Intune PKCS connector previously created.\n\n Cron scheduling ( cron expression ) :\n\nBy default set at every 5 hours.\n\n Enroll? (boolean) :\n\nIf enabled, will enroll all certificate from the third party repository.\nSet to false by default.\n\n Revoke? (boolean) :\n\nIf enabled, will revoke all certificate whose container was deleted from the third party repository.\nSet to false by default.\n\n Renew? (boolean) :\n\nIf enabled, will renew all certificate who are about to expire.\nSet to false by default.\n\n Dry run (boolean) :\n\nIf enabled, enroll, revocation and renewal actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run or update or delete the Schedules Tasks.\n\n Intune PKCS Profile\n Intune PKCS Trigger", - "keywords": [ - "intune", - "pkcs", - "scheduled", - "tasks", - "admin-guide", - "admin-guide/third-parties/intune_pkcs/intune_pkcs_scheduled_tasks", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:intune_pkcs:intune_pkcs_trigger", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Intune PKCS Trigger", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune_pkcs/intune_pkcs_trigger", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/intune_pkcs/intune_pkcs_trigger.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/intune_pkcs/intune_pkcs_trigger.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Intune PKCS", - "Intune PKCS Trigger" - ], - "summary": "Intune PKCS Trigger This section details how to configure the Triggers that will run automatically on your Intune PKCS connectors. Prerequisites Intune PKCS Connector How to configure Intune PKCS Trigger 1. Log in to Horizon Administration ", - "content": "Intune PKCS Trigger\n\n This section details how to configure the Triggers that will run automatically on your Intune PKCS connectors.\n\n Prerequisites\n\n Intune PKCS Connector\n\n How to configure Intune PKCS Trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune PKCS Triggers from the drawer or card: Third Parties   Intune PKCS   Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n Intune PKCS Connector * (select) :\n\nSelect an Intune PKCS connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the Intune PKCS repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can update or delete the Intune PKCS Trigger.\n\n You won’t be able to delete an Intune PKCS Trigger if it is referenced in any other configuration element.\n\n Intune PKCS Scheduled Tasks\n Jamf Introduction", - "keywords": [ - "intune", - "pkcs", - "trigger", - "admin-guide", - "admin-guide/third-parties/intune_pkcs/intune_pkcs_trigger", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:intune:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Intune Introduction", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/intune/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/intune/introduction.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Intune", - "Intune Introduction" - ], - "summary": "Intune Introduction This section details the Microsoft Endpoint Manager - Intune SCEP integration with Horizon, used to enroll, renew and revoke certificates on Intune managed devices. This integration involves at least three infrastructure", - "content": "Intune Introduction\n\n This section details the Microsoft Endpoint Manager - Intune SCEP integration with Horizon, used to enroll, renew and revoke certificates on Intune managed devices.\n\n This integration involves at least three infrastructure components:\n\n Microsoft Endpoint Manager / Intune\n\n Azure Active Directory\n\n EverTrust Horizon\n\n The enrolled devices interface with these components in order to retrieve their certificate.\n\n The diagram displays these components as well as the various flows involved in an enrollment.\n\n Microsoft describes the integration principles on their website: https://docs.microsoft.com/en-us/mem/intune/protect/certificate-authority-add-scep-overview\n\n Finally, this integration will require to set up, on Horizon side, the following elements:\n\n an Intune Connector , which holds the configuration items required for Horizon to connect to Azure AD and Intune\n\n an Intune Profile , which holds the configuration items specifying how Horizon should issue certificates for the specified Intune Connector\n\n an Intune Scheduled Task , which holds configuration items defining the scheduled task in charge of performing revocation upon decommissioning devices from Azure AD. This is optional.\n\n LDAP Triggers\n Intune Connector", - "keywords": [ - "intune", - "introduction", - "admin-guide", - "admin-guide/third-parties/intune/introduction", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:intune:intune_connector", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Intune Connector", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune/intune_connector", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/intune/intune_connector.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/intune/intune_connector.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Intune", - "Intune Connector" - ], - "summary": "Intune Connector This section details how to configure an Intune Connector. Required By Intune Profile Intune Connector Prerequisites On Horizon side, you might need to set up a Proxy , used to reach Azure/Intune, if necessary. Note that th", - "content": "Intune Connector\n\n This section details how to configure an Intune Connector.\n\n Required By\n\n Intune Profile\n\n Intune Connector\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy , used to reach Azure/Intune, if necessary.\nNote that the Horizon instance must also be reachable from the Azure AD endpoint, hence being reachable from the Internet.\n\n On Azure AD side, it is required to set up an application by following Microsoft’s guide . Please note that you must add the Microsoft Graph / Directory.Read.All permission as well for the revocation feature to work properly. After performing these steps, you will get the following information, required later:\n\n the Tenant ID\n\n the Application ID\n\n the Application Authentication Key\n\n How to configure Intune Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune Connector from the drawer or card: Third Parties   Intune   Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Azure Tenant * (string input) :\n\nEnter the Tenant ID.\n\n App ID * (string input) :\n\nEnter the Application ID.\n\n App Key * (string input) :\n\nEnter the Application Authentication Key.\n\n Proxy (string select) :\n\nThe HTTP/HTTPS proxy used to reach Azure AD and Intune.\n\n Timeout ( finite duration ) :\n\nTimeout set on the connection used to reach Azure AD and Intune. Configured by default at 10 seconds. Must be a valid finite duration.\n\n Assets identification and management\n\n OS query string (string input) :\n\nThis allows to restrict devices by OS when performing the devices listing used for the revocation feature. Leave blank to use the default setting if unsure.\n\n Intune resource URL (string input) :\n\nThis allows to point at a specific Intune installation. Used only in Hybrid Intune setups, leave blank otherwise.\n\n Legacy revocation mode (boolean) :\n\nActivate the legacy revocation mode. Default value is set to false.\n\n Actors management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default to 3.\n\n 5. Click on the save button.\n\n You can update or delete the Intune Connector.\n\n You will not be able to delete an Intune Connector if it is referenced in any other configuration element.\n\n Intune Introduction\n Intune Profile", - "keywords": [ - "intune", - "connector", - "admin-guide", - "admin-guide/third-parties/intune/intune_connector", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:intune:intune_profile", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Intune Profile", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune/intune_profile", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/intune/intune_profile.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/intune/intune_profile.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Intune", - "Intune Profile" - ], - "summary": "Intune Profile This section details how to configure an Intune Profile. Required By Intune Scheduled Tasks Prerequisites Intune Connector PKI Connector SCEP Authority Setting up an SCEP Authority requires you to issue a certificate from the", - "content": "Intune Profile\n\n This section details how to configure an Intune Profile.\n\n Required By\n\n Intune Scheduled Tasks\n\n Prerequisites\n\n Intune Connector\n\n PKI Connector\n\n SCEP Authority\n\n Setting up an SCEP Authority requires you to issue a certificate from the underlying PKI with the following characteristics:\n\n the issuing CA should be the same as the one that will issue certificates through the PKI Connector that will be linked to the Intune Profile\n\n the certificate key usages must include Digital Signature and Key Encipherment\n\n the certificate must be issued as PKCS#12 and then imported into Horizon\n\n How to configure Intune Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune Profile from the drawer or card: Third Parties   Intune   Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Intune Profile Specific Configuration\n\n General\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of an URL, it is advised to use only lower case letters and dashes.\n\n Enable * (boolean) :\n\nIndicates whether the profile is enabled or not. Set to true by default.\n\n Intune Connector * (select) :\n\nSelect an Intune Connector previously created.\n\n PKI Connector (string select) :\n\nSelect a PKI connector previously created.\n\n Assets identification\n\n Device ID field name (string input) :\n\nSubject DN field used to retrieve the Device ID. The selected field must be set to {{AAD_Device_ID}} on Intune side, e.g. if you select \"L\", the configured Subject DN in the SCEP profile in Intune must then contain L={{AAD_Device_ID}} . This is required to use the automated revocation feature upon device decommission.\n\n Device ID separator (string input) :\n\nSeparator used to retrieve the Device ID in the device id field (if defined). This field is present for backward compatibility reasons and should normally be left to blank.\n\n SCEP protocol parameters\n\n Mode * (select) :\n\nChoose from one of the two modes RA or CA. Usually this should be set to RA .\n\n SCEP Authority (select) :\n\nSelect a SCEP Authority previously created. See Prerequisites for details.\n\n CAPS (select) :\n\nSelect one or many SCEP Capabilities from the list. If unsure, leave the default.\n\n Encryption algorithm (select) :\n\nSelect a SCEP Encryption Algorithm algorithms from the list. If unsure, leave the default.\n\n Crypto Policy\n\n Authorized Key Types (multiselect) :\n\nKey Types that can be used for enrollment. An empty value means no restrictions.\n\n Max Certificate per Holder Policy\n\n Maximum (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Behavior (select) :\n\nWhat behavior to have when the maximum number is reached:\n\n revoke the previous certificates.\n\n reject the current request.\n\n Revocation reason (select) :\n\nWhen the revoke behavior is selected, the revocation reason to revoke the certificate with.\n\n Common configuration for profiles\n\n Languages\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of this profile.\n\n Description (string input) :\n\nEnter a description. This will be displayed on the list view of the profiles.\n\n You can delete the localization.\n\n Grading Policies\n\n You can select grading policies that will grade your certificate for a quick overview of its quality.\nFor more information about the inner working of the grading policies in Horizon, please refer to the grading rules page .\n\n Workflows builder\n\n Configure custom rights for actions on this profile.\n\n 1. Select an authorization level for each workflow.\n\n Everyone :\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live\n\n Configure the time your requests have before expiring.\n\nAfter expiration, requests are stored for an additional 30 days. This can be changed using configuration files .\n\n Enrollment request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Renewal request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Revocation request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Update request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Migration request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Recover request ( finite duration ) :\n\n Enabled on escrow : Must be a valid finite duration. The default value is set to seven days.\n\n Self Permissions\n\n These permissions apply to the owners of a certificate (team or owner). An owner can always request the following actions, but this permission allows them to perform the action without validation.\n\n Revoke (boolean) :\n\nGrant self revoke permission. The default value is set to false.\n\n Update (boolean) :\n\nGrant self update permission. The default value is set to false.\n\n Constraints\n\n Allowed email domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\nThis matches the domain of the email, not including anything before @ .\n\n Allowed DNS domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n CSR Data Mapping\n\n 1. Click on to add a mapping.\n\n 2. Select a field and enter a value.\n\n You can delete the CSR Data Mapping.\n\n Certificate Metadata\n\n This section details how to define a custom structure for the labels, ownership policy and technical metadata, allowing certificates to hold rich information.\n\n Labels\n\n You can add more labels by clicking .\n\n Name (select) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nShould the label be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Open the popup, enter the label value and press \"enter\" to add this value to the accepted value list. An empty whitelist means no restriction.\n\n Suggestions (string input multiple) :\n\nAdd suggestions that will be displayed to the user. The user will be able to choose one of these values or enter its own. Open the popup, enter your suggestions and press enter to add this value to the suggestions. An empty suggestions list means no restriction.\n\n Regex ( regex ) :\n\nThe label value will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this label to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can delete or reorder (drag and drop) the label template.\n\n Ownership policy\n\n Owner\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s owner is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the owner to the value of the evaluated computation rule . This value will override any other value including the user input.\n\n Contact email\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s contact email is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when approving a request.\n\n Default contact email (string input) :\n\nSet a default contact email. This value must comply with the contact email restriction.\n\n Contact email restriction\n\n Whitelist (string input multiple) :\n\nThe contact email will have to be in the whitelist. Open the popup, enter the email and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe contact email will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the contact email to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Team\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s team is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe team will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the team to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Metadata policy (overridable metadata)\n\nThese metadata are technical metadata. They are used by Horizon or Third party connectors, updating them should be done with utmost care.\n\nMetadata edition is not allowed on enroll.\n\nMetadata edition is not available via the User Interface. It must be changed with API, using horizon-cli.\n\n You can allow the override of technical metadata by clicking .\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n You can delete a metadata policy. This will not delete the metadata but will make it non editable.\n\n Notifications\n\n This section details how to configure notifications on certificate and request lifecycle events.\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n Renew\n\n Select a preexisting email or groupware notification to associate it with an event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by an Enroll/Revocation/Update/Migrate/Renew request:\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n Select a preexisting email or groupware notification to associate it with an event.\n\nSubmit request events are not triggered when the user has the permission to perform the action directly.\n\n 5. Click on the save button.\n\n You can update or delete the Intune Profile once it has been created.\n\n You won’t be able to delete an Intune Profile if it is referenced somewhere else.\n\n Last steps\n\n Once the profile is created in Horizon, you need to setup a SCEP profile in Intune by following Microsoft documentation . You will need to match the parameters in the Intune SCEP profile with what has been set up in Horizon and in the underlying PKI. You need to pay special attention to:\n\n the certificate lifetime and renewal interval, which must match throughout the solution\n\n the Subject and Subject Alternative Name settings must match throughout the solution. In the end, the issued certificate must contain exactly what was configured in Intune for these fields, or the renewal will not work.\n\n the SCEP server URL, where you need to input the URL given in the Intune Profile that you created in Horizon\n\n To enroll Windows machines or users using Intune, you need to remove the trailing \" pkiclient.exe \" from the SCEP server URL\n\n Intune Connector\n Intune Scheduled Tasks", - "keywords": [ - "intune", - "profile", - "admin-guide", - "admin-guide/third-parties/intune/intune_profile", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:intune:intune_scheduled_task", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Intune Scheduled Tasks", - "section": "admin-guide", - "slug": "admin-guide/third-parties/intune/intune_scheduled_task", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/intune/intune_scheduled_task.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/intune/intune_scheduled_task.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Intune", - "Intune Scheduled Tasks" - ], - "summary": "Intune Scheduled Tasks This section details how to configure scheduled tasks which will run periodically on your Intune profiles, in order to manage automatic revocation upon device decommission. Prerequisites Intune Connector Intune Profil", - "content": "Intune Scheduled Tasks\n\n This section details how to configure scheduled tasks which will run periodically on your Intune profiles, in order to manage automatic revocation upon device decommission.\n\n Prerequisites\n\n Intune Connector\n\n Intune Profile\n\n How to configure Intune Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Intune Scheduled Tasks from the drawer or card: Third Parties   Intune   Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Intune Profile * (select) :\n\nSelect an Intune profile previously created.\n\n Target Connector * (select) :\n\nSelect an Intune connector previously created.\n\n Cron scheduling ( cron expression ) :\n\nSet to every 5 hours by default.\n\n Revoke (boolean) :\n\nSet to false by default. If true, Horizon will revoke any certificate associated to a device that has been deleted from Azure AD (and hence decommissioned).\n\n Dry run (boolean) :\n\nIf enabled, revocation actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run , update or delete the Scheduled Tasks.\n\n Intune Profile\n Intune PKCS Introduction", - "keywords": [ - "intune", - "scheduled", - "tasks", - "admin-guide", - "admin-guide/third-parties/intune/intune_scheduled_task", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:jamf:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Jamf Introduction", - "section": "admin-guide", - "slug": "admin-guide/third-parties/jamf/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/jamf/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/jamf/introduction.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Jamf", - "Jamf Introduction" - ], - "summary": "Jamf Introduction This section details the Jamf Pro integration with Horizon, used to enroll, renew and revoke certificates on Jamf Pro managed devices. This integration involves the following components: Jamf Pro server or Cloud instance E", - "content": "Jamf Introduction\n\n This section details the Jamf Pro integration with Horizon, used to enroll, renew and revoke certificates on Jamf Pro managed devices.\n\n This integration involves the following components:\n\n Jamf Pro server or Cloud instance\n\n EverTrust Horizon\n\n Devices to be enrolled\n\n The diagram displays these components as well as the various flows involved in an enrollment.\n\n Finally, this integration will require to setup, on Horizon side, the following elements:\n\n a Jamf Connector , which holds the configuration items required for Horizon to connect to Jamf Pro\n\n a Jamf Profile , which holds the configuration items specifying how Horizon should issue certificates for the specified Jamf Connector\n\n a Jamf Schedule Task , which holds configuration items defining the scheduled task in charge of performing revocation upon decommissioning devices from Jamf Pro. This is optional.\n\n Intune PKCS Trigger\n Jamf Connector", - "keywords": [ - "jamf", - "introduction", - "admin-guide", - "admin-guide/third-parties/jamf/introduction", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:jamf:jamf_connector", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Jamf Connector", - "section": "admin-guide", - "slug": "admin-guide/third-parties/jamf/jamf_connector", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/jamf/jamf_connector.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/jamf/jamf_connector.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Jamf", - "Jamf Connector" - ], - "summary": "Jamf Connector This section details how to configure a Jamf Connector. Required By Jamf Profile Prerequisites On Horizon side, you might need to set up a Proxy used to reach Jamf Pro, if necessary. On Jamf Pro side, it is required to create", - "content": "Jamf Connector\n\n This section details how to configure a Jamf Connector.\n\n Required By\n\n Jamf Profile\n\n Prerequisites\n\n On Horizon side, you might need to set up a Proxy used to reach Jamf Pro, if necessary.\n\n On Jamf Pro side, it is required to create a technical user for Horizon, and give it Auditor rights, so that Horizon will be able to list the devices managed by Jamf Pro and thus be able to trigger certificate revocation upon decommissioning. Please follow the steps from the Jamf Pro documentation . After performing these steps, you will be given the following information, required later:\n\n a login\n\n a password\n\n How to configure Jamf Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Jamf Connector from the drawer or card: Third Parties   Jamf   Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Jamf endpoint URL * (string input) :\n\nEnter the URL pointing to the Jamf deployment or the Jamf Cloud instance.\n\n Login * (string input) :\n\nEnter the username created for Horizon in Jamf.\n\n Password * (string input) :\n\nEnter the password associated with aforementioned username.\n\n Proxy (string select) :\n\nThe HTTP/HTTPS proxy used to reach Jamf Pro, if any.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be a valid finite duration.\n\n Actors management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default to 3.\n\n 5. Click on the save button.\n\n You can update or delete the Jamf Connector.\n\n You won’t be able to delete a Jamf Connector if it is referenced in any other configuration element.\n\n Jamf Introduction\n Jamf Profile", - "keywords": [ - "jamf", - "connector", - "admin-guide", - "admin-guide/third-parties/jamf/jamf_connector", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:jamf:jamf_profile", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Jamf Profile", - "section": "admin-guide", - "slug": "admin-guide/third-parties/jamf/jamf_profile", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/jamf/jamf_profile.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/jamf/jamf_profile.html", - "breadcrumbs": ["Horizon", "Admin guide", "MDM", "Jamf", "Jamf Profile"], - "summary": "Jamf Profile This section details how to configure a Jamf Profile Prerequisites Jamf Connector PKI Connector SCEP Authorities The SCEP Authority setup requires you to issue a certificate from the underlying PKI with the following characteri", - "content": "Jamf Profile\n\n This section details how to configure a Jamf Profile\n\n Prerequisites\n\n Jamf Connector\n\n PKI Connector\n\n SCEP Authorities\n\n The SCEP Authority setup requires you to issue a certificate from the underlying PKI with the following characteristics:\n\n to issue certificates for iOS:\n\n the issuing CA should be the same as the one that will issue certificates through the PKI Connector that will be linked to the Jamf Profile\n\n the certificate key usages must include Digital Signature and Key Encipherment\n\n the certificate must be issued as PKCS#12 and then imported into Horizon\n\n to issue certificates for macOS:\n\n the certificate should be self-signed\n\n the certificate key usages must include Digital Signature and Key Encipherment\n\n the certificate must be issued as PKCS#12 and then imported into Horizon\n\n How to configure Jamf Profile\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Jamf Profiles from the drawer or card: Third Parties   Jamf   Profiles .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Jamf Profile Specific Configuration\n\n General\n\n Name * (string input) :\n\nEnter a meaningful profile name. It must be unique for each profile. Horizon uses the name to identify the profile. As the name will be part of an URL, it is advised to use only lower case letters and dashes.\n\n Enable (boolean) :\n\nIs the profile enabled or not. Set at true by default.\n\n Jamf Connector (select) :\n\nSelect a Jamf connector previously created.\n\n PKI connector * (string select) :\n\nSelect a PKI connector previously created.\n\n Assets identification\n\n DN field containing the device UDID * (select) :\n\nField used to retrieve the Device ID. The selected field must be set to $UDID/$COMPUTERNAME on Jamf side, e.g. if you select \"L\", the configured Subject DN in the SCEP profile in Jamf pro must then contain L=$UDID for iOS or L=$COMPUTERNAME for macOS devices. This allows to use the automated revocation upon device decommissioning feature.\n\n SCEP protocol parameters\n\n Mode * (select) :\n\nChoose from the two modes RA or CA. To enroll certificates on iOS devices, select the RA mode. To enroll certificates on macOS , select the CA mode.\n\n SCEP Authority * (select) :\n\nSelect a SCEP Authority previously created. See Prerequisites for details.\n\n CAPS (select) :\n\nSelect one or many SCEP Capabilities from the list. If unsure, leave the default.\n\n Encryption algorithm * (select) :\n\nSelect a SCEP Encryption Algorithm algorithms from the list. If unsure, leave the default.\n\n Password policy (select) :\n\nChoose from the password policy you might have previously created. If unsure, leave the default.\n\n Crypto Policy\n\n Authorized Key Types (multiselect) :\n\nKey Types that can be used for enrollment. An empty value means no restrictions.\n\n Max Certificate per Holder Policy\n\n Maximum (int) :\n\nWhen specified, define the maximum number of active certificates for a given Holder.\n\n Behavior (select) :\n\nWhat behavior to have when the maximum number is reached:\n\n revoke the previous certificates.\n\n reject the current request.\n\n Revocation reason (select) :\n\nWhen the revoke behavior is selected, the revocation reason to revoke the certificate with.\n\n Common configuration for profiles\n\n Languages\n\n You can add more languages by clicking .\n\n Language * (select) :\n\nSelect a language. Supported languages are:\n\n en : English\n\n fr : French\n\n Display Name (string input) :\n\nEnter a display name. This will be the localized name of this profile.\n\n Description (string input) :\n\nEnter a description. This will be displayed on the list view of the profiles.\n\n You can delete the localization.\n\n Grading Policies\n\n You can select grading policies that will grade your certificate for a quick overview of its quality.\nFor more information about the inner working of the grading policies in Horizon, please refer to the grading rules page .\n\n Workflows builder\n\n Configure custom rights for actions on this profile.\n\n 1. Select an authorization level for each workflow.\n\n Everyone :\n\nNo authentication is required.\n\n Authenticated :\n\nUser has to be authenticated.\n\n Authorized :\n\nUser has to be authenticated and have an explicit authorizations.\n\n 2. Select an access level for identity providers.\n\n You can remove the access level for an identity provider by clicking on 'x'.\n\n Requests time to live\n\n Configure the time your requests have before expiring.\n\nAfter expiration, requests are stored for an additional 30 days. This can be changed using configuration files .\n\n Enrollment request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Renewal request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Revocation request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Update request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Migration request * ( finite duration ) :\n\nMust be a valid finite duration. The default value is set to seven days.\n\n Recover request ( finite duration ) :\n\n Enabled on escrow : Must be a valid finite duration. The default value is set to seven days.\n\n Self Permissions\n\n These permissions apply to the owners of a certificate (team or owner). An owner can always request the following actions, but this permission allows them to perform the action without validation.\n\n Revoke (boolean) :\n\nGrant self revoke permission. The default value is set to false.\n\n Update (boolean) :\n\nGrant self update permission. The default value is set to false.\n\n Constraints\n\n Allowed email domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\nThis matches the domain of the email, not including anything before @ .\n\n Allowed DNS domains (string input) :\n\nEnter a valid regular expression that the inputted domain should match.\n\n CSR Data Mapping\n\n 1. Click on to add a mapping.\n\n 2. Select a field and enter a value.\n\n You can delete the CSR Data Mapping.\n\n Certificate Metadata\n\n This section details how to define a custom structure for the labels, ownership policy and technical metadata, allowing certificates to hold rich information.\n\n Labels\n\n You can add more labels by clicking .\n\n Name (select) :\n\nSelect a preexisting label .\n\n Mandatory (boolean) :\n\nShould the label be mandatory. The default value is set to false.\n\n Editable by requester (boolean) :\n\nTells whether the label should be editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the label should be editable by the approver. The default value is set to false.\n\n Default value (string input) :\n\nSet a default value to the label.\n\n Label value restriction\n\n Whitelist (string input multiple) :\n\nThe label value will have to be in the whitelist. Open the popup, enter the label value and press \"enter\" to add this value to the accepted value list. An empty whitelist means no restriction.\n\n Suggestions (string input multiple) :\n\nAdd suggestions that will be displayed to the user. The user will be able to choose one of these values or enter its own. Open the popup, enter your suggestions and press enter to add this value to the suggestions. An empty suggestions list means no restriction.\n\n Regex ( regex ) :\n\nThe label value will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of this label to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n You can delete or reorder (drag and drop) the label template.\n\n Ownership policy\n\n Owner\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s owner is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s owner can be overridden by the requester when approving a request.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the owner to the value of the evaluated computation rule . This value will override any other value including the user input.\n\n Contact email\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s contact email is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s contact email can be overridden by the requester when approving a request.\n\n Default contact email (string input) :\n\nSet a default contact email. This value must comply with the contact email restriction.\n\n Contact email restriction\n\n Whitelist (string input multiple) :\n\nThe contact email will have to be in the whitelist. Open the popup, enter the email and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe contact email will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the contact email to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Team\n\n Mandatory (boolean) :\n\nSpecify if the certificate’s team is mandatory when submitting a request.\n\n Editable by requester (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when submitting a request.\n\n Editable by approver (boolean) :\n\nSpecify if the certificate’s team can be overridden by the requester when approving a request.\n\n Default team (string input) :\n\nSet a default team. This value must comply with the team restriction.\n\n Team restriction\n\n Whitelist (string input multiple) :\n\nThe team will have to be in the whitelist. Enter the team and press \"enter\" to add this value to the accepted whitelist. An empty whitelist means no restriction.\n\n Regex ( regex ) :\n\nThe team will have to match the regex. Open the popup, enter the regular expression and click on the submit button to set the regex. An empty regex means no restrictions.\n\n Computation rule ( Computation rule input) :\n\nSet the value of the team to the value of the evaluated computation rule . This value will override any other value including the user input and the default value.\n\n Metadata policy (overridable metadata)\n\nThese metadata are technical metadata. They are used by Horizon or Third party connectors, updating them should be done with utmost care.\n\nMetadata edition is not allowed on enroll.\n\nMetadata edition is not available via the User Interface. It must be changed with API, using horizon-cli.\n\n You can allow the override of technical metadata by clicking .\n\n Metadata * (select) :\n\nSelect a metadata.\n\n Editable by requester (boolean) :\n\nTells whether the metadata is editable by the requester. The default value is set to false.\n\n Editable by approver (boolean) :\n\nTells whether the metadata is editable by the approver. The default value is set to false.\n\n You can delete a metadata policy. This will not delete the metadata but will make it non editable.\n\n Notifications\n\n This section details how to configure notifications on certificate and request lifecycle events.\n\n Certificate lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by a certificate:\n\n Enrollment\n\n Revocation\n\n Expire\n\n Update\n\n Migrate\n\n Renew\n\n Select a preexisting email or groupware notification to associate it with an event.\n\n Request lifecycle notifications\n\n Notifications are sent when one of the following event is triggered by an Enroll/Revocation/Update/Migrate/Renew request:\n\n Submit\n\n Cancel\n\n Revoke\n\n Approve\n\n Pending\n\n Select a preexisting email or groupware notification to associate it with an event.\n\nSubmit request events are not triggered when the user has the permission to perform the action directly.\n\n 5. Click on the save button.\n\n You can update or delete the Jamf Profile .\n\n You won’t be able to delete a Jamf Profile if it is referenced somewhere else.\n\n Last Steps\n\n The integration between Jamf Pro and Horizon can be done in the following modes:\n\n Jamf Pro SCEP Proxy mode\n\n iOS SCEP Profile\n\n macOS SCEP Profile\n\n macOS SCEP Profile with Proxy\n\n In all these modes, the Challenge type to use on Jamf Pro side is Dynamic-Microsoft CA , and you should point to the corresponding mscep and mscep_admin URI on Horizon side, that can be found in the Jamf Profile after it has been created.\n\n Jamf Pro SCEP Proxy mode\n\n This mode requires to provide the SCEP Authority PKCS#12 to Jamf Pro, so that it can be uploaded in the appropriate profile.\n\n Other than that, the configuration looks like the following on Jamf Pro side:\n\n iOS/macOS SCEP Profile\n\n On Jamf Pro side, the profile configuration looks like the following:\n\n macOS SCEP Profile with Proxy\n\n This mode requires:\n\n to set up the SCEP Proxy mode on Jamf Pro side\n\n to configure a profile on Jamf Pro side, that looks like the following:\n\n Jamf Connector\n Jamf Scheduled Tasks", - "keywords": [ - "jamf", - "profile", - "admin-guide", - "admin-guide/third-parties/jamf/jamf_profile", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:jamf:jamf_scheduled_tasks", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Jamf Scheduled Tasks", - "section": "admin-guide", - "slug": "admin-guide/third-parties/jamf/jamf_scheduled_tasks", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/jamf/jamf_scheduled_tasks.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/jamf/jamf_scheduled_tasks.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "MDM", - "Jamf", - "Jamf Scheduled Tasks" - ], - "summary": "Jamf Scheduled Tasks This section details how to schedule tasks that will run periodically on your jamf profiles, in order to manage automatic revocation upon device decommissioning. Prerequisites Jamf Connector Jamf Profile How to configur", - "content": "Jamf Scheduled Tasks\n\n This section details how to schedule tasks that will run periodically on your jamf profiles, in order to manage automatic revocation upon device decommissioning.\n\n Prerequisites\n\n Jamf Connector\n\n Jamf Profile\n\n How to configure Jamf Scheduled Tasks\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access Jamf Scheduled Tasks from the drawer or card: Third Parties   Jamf   Scheduled Tasks .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Enable (boolean) :\n\nTells whether the Scheduled task should be enabled. Set by default at true.\n\n Jamf Profile * (select) :\n\nSelect a Jamf profile previously created.\n\n Target Connector * (select) :\n\nSelect an Jamf connector previously created.\n\n Cron scheduling ( cron expression ) :\n\nSet to every 5 hours by default.\n\n Revoke (boolean) :\n\nSet to false by default. If true, Horizon will revoke any certificate associated to a device that has been deleted from Azure AD (and hence decommissioned).\n\n Dry run (boolean) :\n\nIf enabled, revocation actions will not be performed. Instead, a message will be logged, explaining what would have been done.\n\n 5. Click on the save button.\n\n You can run or update or delete the Scheduled Tasks.\n\n Jamf Profile\n SCEP Authorities", - "keywords": [ - "jamf", - "scheduled", - "tasks", - "admin-guide", - "admin-guide/third-parties/jamf/jamf_scheduled_tasks", - "horizon", - "admin", - "guide", - "mdm" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:ldap:connector", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "LDAP Connector", - "section": "admin-guide", - "slug": "admin-guide/third-parties/ldap/connector", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/ldap/connector.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/ldap/connector.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "LDAP", - "LDAP Connector" - ], - "summary": "LDAP Connector This section details how to configure an LDAP Connector. Required By LDAP Trigger Prerequisites On the LDAP side, it is required to create a technical user with permissions to write in the LDAP sub DN, so that Horizon will be", - "content": "LDAP Connector\n\n This section details how to configure an LDAP Connector.\n\n Required By\n\n LDAP Trigger\n\n Prerequisites\n\n On the LDAP side, it is required to create a technical user with permissions to write in the LDAP sub DN, so that Horizon will be able to search by email, to publish and to unpublish certificates using that technical user. The following information will be required later:\n\n LDAP Hostname\n\n a login DN\n\n a password\n\n Base DN to publish SMIME certificates\n\n How to configure LDAP Connector\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access LDAP Connector from the drawer or card: Third Parties   LDAP   Connectors .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Connection\n\n Name * (string input) :\n\nEnter a meaningful connector name. It must be unique for each connector. Horizon uses the name to identify the connector.\n\n Hostname * (string input) :\n\nEnter the URL pointing to LDAP.\n\n Login DN * (string input) :\n\nEnter the DN technical user created for Horizon.\n\n Password * (string input) :\n\nEnter the password associated with the login.\n\n Base DN * (string input) :\n\nEnter the Base DN where Horizon should publish the certificate.\n\n Max stored certificates per holder * (int) :\n\nWhen specified, define a maximum number of certificates stored in the third party.\n\n Port (int) :\n\nEnter the port where to reach the running LDAP instance (default values are 389 for LDAP and 636 for LDAPS).\n\n Proxy (string select) :\n\nThe HTTP/HTTPS proxy used to reach LDAP, if any.\n\n Timeout ( finite duration ) :\n\nSet by default at 10 seconds. Must be a valid finite duration.\n\n Assets identification\n\n Filter * (string input) :\n\nEnter the custom filter. By default, LDAP Identities are filtered by (objectclass=user). If you are using inetOrgPerson as type, you will have to manually set the following filter: (objectclass=inetOrgPerson).\n\n Target LDAP publication attribute (string input) :\n\nWhen specified, the certificate will be published on the specified attribute. In most LDAP applications you will have to set the field to: \"userCertificate;binary\" but in MSAD the field is already well managed.\n\n Actors management\n\n These configuration elements mainly define the number of authorized interactions with the remote service on a defined period. For example, one needs to ensure that the remote service will not be contacted more than 5 times per 3 seconds. Throttle parallelism defines the number of times and Throttle duration the period of time. Therefore, on the above example, throttle parallelism would be set to 5 and throttle duration would be set to 3 seconds.\n\n Throttle duration * ( finite duration ) :\n\nSet by default to 3 seconds. Must be a valid finite duration.\n\n Throttle parallelism * (int) :\n\nSet by default to 3.\n\n 5. Click on the save button.\n\n You can update or delete the LDAP Connector.\n\n You won’t be able to delete a LDAP Connector if it is referenced in any other configuration element.\n\n LDAP Introduction\n LDAP Triggers", - "keywords": [ - "ldap", - "connector", - "admin-guide", - "admin-guide/third-parties/ldap/connector", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:ldap:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "LDAP Introduction", - "section": "admin-guide", - "slug": "admin-guide/third-parties/ldap/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/ldap/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/ldap/introduction.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "LDAP", - "LDAP Introduction" - ], - "summary": "LDAP Introduction This section details the LDAP integration with Horizon, used to publish and unpublish certificates on LDAP. The integration will require to set up the following elements (on Horizon side): an LDAP Connector, which holds th", - "content": "LDAP Introduction\n\n This section details the LDAP integration with Horizon, used to publish and unpublish certificates on LDAP.\n\n The integration will require to set up the following elements (on Horizon side):\n\n an LDAP Connector, which holds the configuration items required by Horizon to connect to LDAP\n\n an LDAP Trigger, which holds the configuration items specifying how Horizon should publish/unpublish certificates for the specified LDAP connector\n\n Only SMIME Certificates can be published\n\n F5 Trigger\n LDAP Connector", - "keywords": [ - "ldap", - "introduction", - "admin-guide", - "admin-guide/third-parties/ldap/introduction", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:third-parties:ldap:triggers", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "LDAP Triggers", - "section": "admin-guide", - "slug": "admin-guide/third-parties/ldap/triggers", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/third-parties/ldap/triggers.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/third-parties/ldap/triggers.html", - "breadcrumbs": [ - "Horizon", - "Admin guide", - "Third parties", - "LDAP", - "LDAP Triggers" - ], - "summary": "LDAP Triggers Here is the section to manage the Triggers that will be used by profiles to publish or unpublish certificates into LDAP. Prerequisites LDAP Connector How to configure LDAP trigger 1. Log in to Horizon Administration Interface.", - "content": "LDAP Triggers\n\n Here is the section to manage the Triggers that will be used by profiles to publish or unpublish certificates into LDAP.\n\n Prerequisites\n\n LDAP Connector\n\n How to configure LDAP trigger\n\n 1. Log in to Horizon Administration Interface.\n\n 2. Access LDAP triggers from the drawer or card: Third Parties   LDAP   Triggers .\n\n 3. Click on .\n\n 4. Fill the mandatory fields.\n\n Name * (string input) :\n\nEnter a meaningful trigger name. It must be unique for each trigger. Horizon uses the name to identify the trigger.\n\n LDAP Connector Certificate Publication * (select) :\n\nSelect an LDAP connector previously created.\n\n Retries in case of error (int) :\n\nNumber of times to retry to push the change on the Intune PKCS repository in case of error. Must be an integer between 1 and 15.\n\n 5. Click on the save button.\n\n You can run or update or delete the trigger.\n\n Synchronization using triggers\n\n Triggers are a functionality of WebRA , Intune PKCS , WCCE and CRMP profiles that allows to push lifecycle events into a third party whenever they occur on a profile.\n\n 1. Refer to the trigger documentation to create a trigger.\n\n 2. Create or modify the profile you wish to use the triggers on.\n\n 3. Go to the Triggers tab, then on Certificate lifecycle triggers\n\n 4. Chose which lifecycle events you wish to use triggers upon (enrollment, revocation, expiration)\n\n 5. Select one or more existing triggers from the menu (if several are selected, they will all be called whenever the selected event occurs)\n\n 6. Click on the Save button.\n\n From now on, whenever a selected lifecycle event will occur on the configured profile, the trigger will be called and the and the certificate will be pushed into or removed from the third party container.\n\n LDAP Connector\n Intune Introduction", - "keywords": [ - "ldap", - "triggers", - "admin-guide", - "admin-guide/third-parties/ldap/triggers", - "horizon", - "admin", - "guide", - "third", - "parties" - ] - }, - { - "page_id": "horizon:2.4:admin-guide:user_informations", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "User Information", - "section": "admin-guide", - "slug": "admin-guide/user_informations", - "url": "https://docs.evertrust.fr/horizon/2.4/admin-guide/user_informations.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/admin-guide/user_informations.html", - "breadcrumbs": ["Horizon", "Admin guide", "User Information"], - "summary": "User Information This is the section where to find all your profile information (identifier, email, name, authentication type, role and permissions), your preferences and change your account password (local account authentication only). Pro", - "content": "User Information\n\n This is the section where to find all your profile information (identifier, email, name, authentication type, role and permissions), your preferences and change your account password (local account authentication only).\n\n Profile access\n\n 1. Log in to Horizon.\n\n 2. Access your profile from the header by clicking on your account name.\n\n How to change your password\n\n 1. Profile access\n\n 2. Fill your local password and confirm it.\n\n 3. Click on the 'Change Password' button.\n\n Changing your password is only available if you are using a local account.\n\n How to change your preferences\n\n 1. Profile access\n\n 2. Change your preferences:\n\n Appearance (light/dark mode)\n\n Horizon default language\n\n 3. Click on the 'Save' button.\n\n Introduction\n Certification Authorities", - "keywords": [ - "user", - "information", - "admin-guide", - "admin-guide/user_informations", - "horizon", - "admin", - "guide" - ] - }, - { - "page_id": "horizon:2.4:install-guide:docker", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Running with Docker/Compose", - "section": "install-guide", - "slug": "install-guide/docker", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/docker.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/docker.html", - "breadcrumbs": ["Horizon", "Installation", "Running with Docker/Compose"], - "summary": "Running with Docker/Compose If you just want to try out Horizon, one way of doing so could be to directly run Horizon from Docker. For resiliency reasons, this is obviously not recommended for production usage. We provide a Docker image tha", - "content": "Running with Docker/Compose\n\n If you just want to try out Horizon, one way of doing so could be to directly run Horizon from Docker. For resiliency reasons, this is obviously not recommended for production usage.\n\n We provide a Docker image that’s entirely configurable through environment variables. All Docker examples require that you login to our Docker repository beforehand :\n\n $ docker login registry.evertrust.io\n\n Contact our support team to retrieve your license file if you don’t have it already. Horizon won’t be able to boot without a valid license.\n\n Docker Compose example\n\n The simplest way to spin up an Horizon instance is to let Docker Compose manage the required components :\n\n the database,\n\n the Horizon instance\n\n and (optionally) the reverse proxy.\n\n Copy the following docker-compose.yaml file and tweak it to match your needs :\n\n version: \"3.1\"\nservices:\n horizon:\n image: registry.evertrust.io/horizon:2.4.x\n ports:\n - \"9000:9000\"\n networks:\n - horizon\n environment:\n LICENSE: MI...\n APPLICATION_SECRET: tobechanged\n EVENT_SEAL_SECRET: tobechanged\n VAULT_TYPE: ssv\n VAULT_MASTER_PASSWORD: tobechanged\n HOSTS_ALLOWED.0: .\n MONGODB_URI: mongodb://mongo:27017/horizon\n depends_on:\n - mongo\n healthcheck:\n test: [ \"CMD\", \"curl\", \"-f\", \"http://localhost:8558/ready\" ]\n interval: 10s\n timeout: 60s\n retries: 10\n mongo:\n image: mongo:5\n restart: always\n volumes:\n - database:/data/db\n networks:\n - horizon\nvolumes:\n database: {}\nnetworks:\n horizon: {}\n\n You then only need to run the following in the directory where you created the previous file :\n\n $ docker compose up\n\n Horizon should quickly become available on http://localhost:9000 .\n\n Vanilla Docker example\n\n Pull the latest Horizon image:\n\n $ docker pull registry.evertrust.io/horizon:2.4.x\n\n The Horizon Docker image ships with sensible configuration defaults. Most can be configured by injecting environment variables when running the container, like so:\n\n $ docker run \\\n -e LICENSE=\"MI...\"\n -e APPLICATION_SECRET=\"tobechanged\"\n -e EVENT_SEAL_SECRET=\"tobechanged\"\n -e VAULT_TYPE=\"ssv\"\n -e VAULT_MASTER_PASSWORD=\"tobechanged\"\n -e HOSTS_ALLOWED.0=\".\"\n -e MONGODB_URI=\"\"\n -p [port]:9000 \\\n registry.evertrust.io/horizon:2.4.x\n\n Environment variables\n\n General configuration\n\n Variable\n Type\n Description\n Default\n\n LICENSE\n\n string\n\n A valid Horizon license string, base64-encoded. Can be used if LICENSE_PATH is empty.\n\n LICENSE_PATH\n\n path\n\n Path where an Horizon license file is mounted inside the container. Can be used if the license is not passed directly through LICENSE .\n\n APPLICATION_SECRET\n\n string\n\n Application secret used by Horizon\n\n MONGODB_URI\n\n string\n\n A valid MongoDB URI. See iaas/setup/horizon.adoc#mongo_uri_config .\n\n HOSTS_ALLOWED\n\n array\n\n Array of hosts. Append the array index after a dot (the nth allowed host variable name would be HOSTS_ALLOWED.n).\n\n Your license usually contains newline characters, that you must replace by '\\n' when setting it through the environment.\n\n Configure the secrets vault\n\n Variable\n Type\n Description\n Default\n\n VAULT_TYPE\n\n string\n\n Vault backend. ssv for a software encrypted vault. shv for a PKCS#11 HSM.\n\n VAULT_MASTER_PASSWORD\n\n string\n\n When using an ssv vault, this encryption key backs all secrets encrypted in database.\n\n VAULT_MODULE_PATH\n\n string\n\n Used to connect to an HSM.\n\n VAULT_SLOT_ID\n\n string\n\n Used to connect to an HSM.\n\n VAULT_PIN\n\n string\n\n Used to connect to an HSM.\n\n VAULT_LABEL\n\n string\n\n Used to connect to an HSM.\n\n VAULT_ALLOW_MASTER_KEY_GEN\n\n string\n\n Allow key generation on PKCS#11 devices when no existing is found.\n\n Configuring HTTPS\n\n In production, it is strongly recommended to ensure all requests go through a layer of encryption. Configuring TLS for Horizon will allow your reverse proxy to request Horizon data using TLS.\n\n If all settings are left empty, Horizon will generate a self-signed certificate upon startup and still expose its HTTPS endpoint on\n\n Variable\n Type\n Description\n Default\n\n HTTP_PORT\n\n port\n\n Port of the HTTP server\n\n 9000\n\n HTTPS_PORT\n\n port\n\n Port of the HTTPS server\n\n 9443\n\n HTTPS_KEYSTORE_PATH\n\n string\n\n Location where the keystore containing a server certificate is located.\n\n HTTPS_KEYSTORE_PASSWORD\n\n string\n\n Password for the given keystore, if required by the keystore type\n\n HTTPS_KEYSTORE_TYPE\n\n string\n\n Format in which the keystore is. Can be either pkcs12 , jks or pem (a base64-encoded DER certificate)\n\n pkcs12\n\n HTTPS_KEYSTORE_ALGORITHM\n\n string\n\n The key store algorithm\n\n Platform default algorithm\n\n Mailer configuration\n\n Variable\n Type\n Description\n Default\n\n SMTP_HOST\n\n string\n\n SMTP host\n\n SMTP_PORT\n\n string\n\n SMTP port\n\n SMTP_SSL\n\n boolean\n\n Whether SSL should be used\n\n SMTP_TLS\n\n boolean\n\n Whether TLS should be used\n\n SMTP_USER\n\n string\n\n SMTP user\n\n SMTP_PASSWORD\n\n string\n\n SMTP password\n\n Events configuration\n\n Variable\n Type\n Description\n Default\n\n EVENT_CHAINSIGN\n\n boolean\n\n Whether to sign events to verify their integrity\n\n true\n\n EVENT_TTL\n\n duration\n\n Event time to live in database\n\n EVENT_DISCOVERY_TTL\n\n duration\n\n Discovery events time to live. Can be shorter in case a large number of discovery events are logged.\n\n Advanced parameters\n\n Variable\n Type\n Description\n Default\n\n AKKA_ACTOR_SYSTEM\n\n string\n\n Name of the actor system used by Akka. Useful if you need to run multiple instances of Horizon in the same Kubernetes namespace.\n\n horizon\n\n SESSION_MAXAGE\n\n string\n\n Log in session duration.\n\n 15 minutes\n\n HTTP_CERTIFICATE_HEADER\n\n string\n\n Header name in which the client certificate should be sent when using mTLS.\n\n Injecting extra configuration\n\n The Docker image comes with a simple enough configuration to get started and test the software. However, it doesn’t include any way to cluster the software with other instances or to edit other specific configurations. If you need to do so, you can mount custom configuration files, giving you full control over how Horizon behaves.\n\n The mounted folder :\n\n MUST contain an akka.conf file configuring the Akka cluster. See the reference config to get an idea over what’s configurable.\n\n CAN contain a application.conf file containing any extra config options unrelated to clustering.\n\n A typical Docker command would then be :\n\n $ docker run \\\n -v [configurationPath]:/opt/horizon/etc/:rw \\\n ...\n registry.evertrust.io/horizon:2.4.x\n\n Installing on Openshift\n Troubleshooting", - "keywords": [ - "running", - "with", - "docker/compose", - "install-guide", - "install-guide/docker", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:access", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Startup & login", - "section": "install-guide", - "slug": "install-guide/iaas/access", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/access.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/access.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Startup & login" - ], - "summary": "Startup & login Starting the Horizon services Access the server through SSH with an account with administrative privileges; Start the horizon service with the following command: $ systemctl start horizon Start the nginx service with the fol", - "content": "Startup & login\n\n Starting the Horizon services\n\n Access the server through SSH with an account with administrative privileges;\n\n Start the horizon service with the following command:\n\n $ systemctl start horizon\n\n Start the nginx service with the following command:\n\n $ systemctl start nginx\n\n Accessing the web UI\n\n Launch a web browser;\n\n Browse to https://[Horizon IP or FQDN] :\n\n Upon first boot, a random administrator password will be generated. To retrieve it, open the /opt/horizon/var/run/adminPassword file.\nThe default administration login is administrator .\n\n Specify the default administration credentials and hit the ' Login ' button:\n\nIt is highly recommended to create a dedicated administration account and delete the default one, or at least modify the default administrator password.\n\n Server Authentication Certificate\n Standard Upgrade", - "keywords": [ - "startup", - "login", - "install-guide", - "install-guide/iaas/access", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:backup", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Backup and Restore", - "section": "install-guide", - "slug": "install-guide/iaas/backup", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/backup.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/backup.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Backup and Restore" - ], - "summary": "Backup and Restore This section details how to back-up and restore Horizon. Back-up and restore operation can be performed using the back-up and restore tool available under /opt/horizon/sbin/horizon-backup . It is designed to be used only ", - "content": "Backup and Restore\n\n This section details how to back-up and restore Horizon. Back-up and restore operation can be performed using the back-up and restore tool available under /opt/horizon/sbin/horizon-backup . It is designed to be used only in RPM-Based deployments.\n\n For Docker or Kubernetes based deployments, the configuration should be managed by the Docker/Kubernetes management platform, and the database should be backed-up using MongoDB tools.\n\n Backup Procedure\n\n This section details how to back up Horizon configuration elements.\n\n Several elements can be backed up:\n\n The Horizon configuration files.\n\n The Horizon MongoDB.\n\n The backup tool allows backing up these elements independently.\n\n $ /opt/horizon/sbin/horizon-backup --help\n usage: horizon-backup [-cdho:qs]\n -c | --conf Backup the configuration files\n -d | --db Backup the MongoDB database\n -h | --help Display the 'horizon-backup' help\n -o | --output [path] Specify the backup output folder (default: '/opt/horizon/var/backup')\n -q | --quiet Quiet mode\n\n To back up the configuration files, run the following command:\n\n $ /opt/horizon/sbin/horizon-backup -c\n\n The configuration files backup consists of a compressed archive ( .tar.gz ) located under /opt/horizon/var/backup/ .\n\n To back up the MongoDB database, run the following command:\n\n $ /opt/horizon/sbin/horizon-backup -d\n\n The MongoDB database backup consists of a compress file ( .gz ) located under /opt/horizon/var/backup/ .\n\n To run a complete backup, execute the following command:\n\n $ /opt/horizon/sbin/horizon-backup -c -d\n\n The backup output folder can be overridden using the -o | --output parameter\n\n The backup tool can operate in quiet mode (when scheduled in a cron job) using the -q | --quiet parameter\n\n Restoration Procedure\n\n This section details how to restore horizon configuration elements.\n\nThis restore procedure only applies to the exact same application version as the backup file.\n\n Restoration operation should be performed while the Horizon service is not running. Stop the Horizon service with the following command:\n\n $ systemctl stop horizon\n\n To restore a configuration backup, run the following command:\n\n $ tar xzpvf [horizon configuration backup archive path] -C/\n\n To restore the MongoDB database, run the following command:\n\n $ mongorestore --uri=\"[MongoDB URI]\" --drop --gzip --archive=[horizon MongoDB backup archive path]\n\n The MongoDB URI can be retrieved from the /etc/default/horizon/_* configuration file, as MONGODB_URI parameter.\n\n The Horizon service can now be started with the following command:\n\n $ systemctl start horizon\n\n Upgrading from a version prior to 2.1.0\n Uninstallation", - "keywords": [ - "backup", - "and", - "restore", - "install-guide", - "install-guide/iaas/backup", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:doctor", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon Doctor", - "section": "install-guide", - "slug": "install-guide/iaas/doctor", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/doctor.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/doctor.html", - "breadcrumbs": ["Horizon", "Horizon Doctor"], - "summary": "Horizon Doctor Horizon Doctor is currently only available for deployments on CentOS/RHEL. To troubleshoot deployments on Kubernetes, use built-in tools like events and logs. Horizon doctor is a tool that performs checks on your Horizon inst", - "content": "Horizon Doctor\n\n Horizon Doctor is currently only available for deployments on CentOS/RHEL. To troubleshoot deployments on Kubernetes, use built-in tools like events and logs.\n\n Horizon doctor is a tool that performs checks on your Horizon installation as well as its required dependencies to ensure that everything is configured properly.\nThe tool is targeted towards troubleshooting during installation or update procedures.\nNote that the tool requires root permissions to run.\n\n Performed checks\n\n At the moment, Horizon Doctor checks for:\n\n OS checks\n\n Checks for installed Horizon version, MongoDB version, Java version, Nginx version, OS Version.\n\n If the OS is a RedHat distribution, checks if the RedHat subscription is active\n\n If Mongo is not installed locally, it notices it as an information log\n\n Checks for SELinux 's configuration: throws a warning if it is enabled, says ok if it is on permissive or disabled\n\n Checks for the status of the necessary services: postfix , mongod , nginx and horizon .\n\n If the postfix service is running, tries to connect via a TCP SYN on the port 25 of the relayhost specified in the /etc/postfix/main.cf file and throws an error if it can’t.\n\n Checks how long the Horizon service has been running for.\n\n Checks if there is an NTP service active on the machine and checks if the system clock is synchronized with the NTP service.\n\n Config checks\n\n Checks for existence and permissions of the configuration file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon\n\n Checks for existence and permissions of the licence file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for existence and permissions of the vault file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for the permission of the Horizon directory (default: /opt/horizon): the permission is expected to be at least 755.\n\n Checks for the existence of the symbolic link for nginx configuration and runs an nginx -t test.\n\n Retrieves the Java heap size parameters that were set for Horizon and throws a warning if the default ones are used (min = 2048 and max = 3072).\n\n Retrieves the Horizon DNS hostname and stores it for a later test (throws an error if it has not been set).\n\n Checks for the Horizon Play Secret and Horizon Event Seal Secret : these are the Horizon application secrets and should be different from default value thus Horizon Doctor throws an error if either of them is equal to the default value ( changeme ).\n\n Retrieves the MongoDB URI (throws a warning if MongoDB is running on localhost; throws an error if MongoDB is running on an external instance but the authSource=admin parameter is missing from the URI).\n\n Parses the Horizon licence file to retrieve its expiration date as well as the licence details (number of holders per category).\n\n Network checks\n\n Runs a MongoDB ping on the URI, then checks for the database used in the URI (throws a warning if the database used is not called horizon ; throws an error if no database is specified in the URI).\n\n Checks for AKKA High Availability settings: if no node hostname is set up, skips the remaining HA checks. If 2 nodes are set up, retrieves which node is running the doctor and checks for the other node. If 3 nodes are set up, retrieves which node is running the doctor and checks for the other 2 nodes.\nThe check runs as:\n\n if curl is installed, runs a curl request on the Node hostname at alive on the management port (default is 8558), and if alive runs another curl request on the Node hostname at /ready on the management port. Both requests should return HTTP/200 if ok, 000 otherwise.\n\n if curl is not installed, uses the built-in Linux TCP socket to run TCP SYN checks on both the HA communication port (default is 25520) and the management port (default is 8558) on the Node hostname.\n\n Checks for firewall configuration . Currently only supports firewalld (RHEL) and a netstat test.\n\n The netstat part will run a netstat command to check if the JVM listening socket is active (listening on port 9000). If netstat is not installed, it will skip this test.\n\n The firewalld part will check if the HTTP and HTTPS services are opened in the firewall and if it detected a HA configuration, it will check if the HA ports (both of them) are allowed through the firewalld. If firewalld is not installed or not active, it will skip this test.\n\n Checks if IPv6 is active in every network interface and throws a warning if it is the case (specifying the interface with IPv6 turned on).\n\n TLS checks\n\n Checks for existence and permissions of the Horizon server certificate file: the permissions are expected to be at least 640 and the file is supposed to belong to the nginx group.\n\n Parses the Horizon server certificate file: it should be constituted of the actual TLS server certificate first, then of every certificate of the trust chain (order being leaf to root). It throws a warning if the certificate is self-signed or raises an error if the trust chain has not been imported. It otherwise tries to reconstitute the certificate trust chain via the openssl verify command, and throws an error if it cannot.\n\n Parses the Horizon server certificate file and checks if the Horizon hostname is present in the SAN DNS names of the certificate, throws an error if it is not there.\n\n Log packing option\n\n If the Horizon doctor is launched with the -l option , it will pack the logs of the last 7 days (in /opt/horizon/var/log ) as well as the startup logs (the /var/log/horizon/horizon.log file) and create a tar archive.\n\n The -l option accepts an optional parameter that should be an integer (1-99) and will pack the logs of the last n days instead, as well as the startup logs.\n\n Note that the Horizon doctor will still perform all of its check; the log packing is done at the very end of the program.\n\n Example of call to pack the logs of the last 7 days:\n\n $ horizon-doctor -l\n\n Example of call to pack the logs of the last 30 days:\n\n $ horizon-doctor -l 30\n\n Saving the doctor’s output\n\n If the Horizon doctor is launched with the -o option , it will perform all of its checks and save the output in the specified file instead of displaying it into the stdout (default is the command line interface).\n\n If you use the option, you must provide a filepath in a writable directory.\n\n Example of call to save the output in a file named horizon-doctor.out instead of the stdout:\n\n $ horizon-doctor -o horizon-doctor.out\n\n Help menu\n\n To display Horizon doctor’s help menu, use the -h option.", - "keywords": [ - "horizon", - "doctor", - "install-guide", - "install-guide/iaas/doctor" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:installation:firewall", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Configure the Firewall", - "section": "install-guide", - "slug": "install-guide/iaas/installation/firewall", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/installation/firewall.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/firewall.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Configure the Firewall" - ], - "summary": "Configure the Firewall Access the server through SSH with an account with administrative privileges; Open port TCP/443 on the local firewall with the following command: $ firewall-cmd --permanent --add-service=https Reload the firewall conf", - "content": "Configure the Firewall\n\n Access the server through SSH with an account with administrative privileges;\n\n Open port TCP/443 on the local firewall with the following command:\n\n $ firewall-cmd --permanent --add-service=https\n\n Reload the firewall configuration with:\n\n $ systemctl restart firewalld\n\n Install Horizon\n Initial Configuration", - "keywords": [ - "configure", - "the", - "firewall", - "install-guide", - "install-guide/iaas/installation/firewall", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:installation:horizon", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Install Horizon", - "section": "install-guide", - "slug": "install-guide/iaas/installation/horizon", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/installation/horizon.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/horizon.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Install Horizon" - ], - "summary": "Install Horizon Installation from the EverTrust repository Create a /etc/yum.repos.d/horizon.repo file containing the EverTrust repository info: [horizon] enabled=1 name=Horizon Repository baseurl=https://repo.evertrust.io/repository/horizo", - "content": "Install Horizon\n\n Installation from the EverTrust repository\n\n Create a /etc/yum.repos.d/horizon.repo file containing the EverTrust repository info:\n\n [horizon]\nenabled=1\nname=Horizon Repository\nbaseurl=https://repo.evertrust.io/repository/horizon-rpm/\ngpgcheck=0\nusername=<username>\npassword=<password>\n\n Replace <username> and <password> with the credentials you were provided.\n\n You can then run the following to install the latest Horizon version:\n\n $ yum install horizon\n\n To prevent unattended upgrades when running yum update, you should pin the Horizon version by adding\n\n exclude=horizon\n\n at the end of the /etc/yum.repos.d/horizon.repo file after installing Horizon.\n\n Installing from RPM\n\n Upload the file horizon-2.4.X-1.noarch.rpm through SCP under /root .\n\n Access the server through SSH with an account with administrative privileges;\n\n Install the Horizon package with the following command:\n\n $ yum localinstall /root/horizon-2.4.X-1.noarch.rpm\n\n Installing the Horizon package will install the following dependencies:\n\n dialog\n\n java-11-openjdk-headless\n\n Please note that these packages may have their own dependencies.\n\n Install NGINX\n Configure the Firewall", - "keywords": [ - "install", - "horizon", - "install-guide", - "install-guide/iaas/installation/horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:installation:mongodb", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Install MongoDB", - "section": "install-guide", - "slug": "install-guide/iaas/installation/mongodb", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/installation/mongodb.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/mongodb.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Install MongoDB" - ], - "summary": "Install MongoDB Mongo DB version 4.2.x to 5.0.x are supported by Horizon Download the latest version of the following Mongo DB 5.x RPMs from the MongoDB web site : mongodb-org mongodb-org-mongos mongodb-org-server mongodb-org-shell mongodb-", - "content": "Install MongoDB\n\nMongo DB version 4.2.x to 5.0.x are supported by Horizon\n\n Download the latest version of the following Mongo DB 5.x RPMs from the MongoDB web site :\n\n mongodb-org\n\n mongodb-org-mongos\n\n mongodb-org-server\n\n mongodb-org-shell\n\n mongodb-org-tools\n\n Download the last version of the mongosh RPM from the MongoDB GitHub .\n\n mongodb-mongosh\n\n Upload the downloaded RPMs through SCP on the server under /root .\n\n Using an account with privileges, install the RPMs using 'yum'. For example, to install MongoDB version 5.0.1, run the following command from the folder containing the RPMs:\n\n $ yum install mongodb-org*\n$ yum install mongodb-mongosh\n\n Enable the service at startup with the following command:\n\n $ systemctl enable mongod\n\n Start the mongod service with the following command:\n\n $ systemctl start mongod\n\n Verify that you can connect to the Mongo instance by running the mongo shell:\n\n $ mongo\n\nYou can disconnect from the shell with ^D\n\n Pre-requisites\n Install NGINX", - "keywords": [ - "install", - "mongodb", - "install-guide", - "install-guide/iaas/installation/mongodb", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:installation:nginx", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Install NGINX", - "section": "install-guide", - "slug": "install-guide/iaas/installation/nginx", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/installation/nginx.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/installation/nginx.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Install NGINX" - ], - "summary": "Install NGINX Access the server through SSH with an account with administrative privileges; Install the NGINX web server using the following command: $ yum install nginx Enable NGINX to start at boot using the following command: $ systemctl", - "content": "Install NGINX\n\n Access the server through SSH with an account with administrative privileges;\n\n Install the NGINX web server using the following command:\n\n $ yum install nginx\n\n Enable NGINX to start at boot using the following command:\n\n $ systemctl enable nginx\n\n Stop the NGINX service with the following command:\n\n $ systemctl stop nginx\n\n Install MongoDB\n Install Horizon", - "keywords": [ - "install", - "nginx", - "install-guide", - "install-guide/iaas/installation/nginx", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:prerequisites", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Pre-requisites", - "section": "install-guide", - "slug": "install-guide/iaas/prerequisites", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/prerequisites.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/prerequisites.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Pre-requisites" - ], - "summary": "Pre-requisites This section describes the system and software pre-requisites to install Horizon. System pre-requisites The following elements are considered as system pre-requisites: A server running EL [7.x-8.x] x64 (CentOS / RHEL) with th", - "content": "Pre-requisites\n\n This section describes the system and software pre-requisites to install Horizon.\n\n System pre-requisites\n\n The following elements are considered as system pre-requisites:\n\n A server running EL [7.x-8.x] x64 (CentOS / RHEL) with the network configured and SELinux disabled;\n\n Base and EPEL CentOS / RHEL [7.x-8.x] x64 repositories activated;\n\n An access with administrative privileges (root) to the server mentioned above;\n\n The IP address / DNS Name of an SMTP relay;\n\n The email address of the Horizon server administrator.\n\n Software pre-requisites\n\n The following elements are considered as software pre-requisites:\n\n The Horizon installation package: horizon-2.4.X-1.noarch.rpm ;\n\n The MongoDB Community Edition package available from the MongoDB web site ;\n\n EPEL repository activated.\n\n As a reminder, EPEL can be activated on CentOS / RHEL by doing the following:\n\n $ yum install epel-release\n\n Introduction\n Install MongoDB", - "keywords": [ - "pre-requisites", - "install-guide", - "install-guide/iaas/prerequisites", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:setup:horizon", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Initial Configuration", - "section": "install-guide", - "slug": "install-guide/iaas/setup/horizon", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/setup/horizon.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/setup/horizon.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Configuration", - "Initial Configuration" - ], - "summary": "Initial Configuration Configuring the SMTP Relay Access the server through SSH with an account with administrative privileges; Run the Horizon Configuration Utility with the following command: $ /opt/horizon/sbin/horizon-config In the main ", - "content": "Initial Configuration\n\n Configuring the SMTP Relay\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' SMTP ':\n\n Specify IP address or the DNS name of the SMTP relay and validate:\n\n The Postfix configuration is updated:\n\n Exit the configuration utility and restart the Postfix service with the following command:\n\n $ systemctl restart postfix\n\n Configuring the Horizon Administrator’s Email Address\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select Administrator :\n\n Specify the email address of the Horizon Administrator and validate:\n\n Exit the Configuration Utility;\n\n Validate the SMTP relay and Administrator Email Address with the following commands:\n\n $ yum install mailx\n$ mail -s \"Hello Horizon root\"\n > Hello From Horizon\n .\n\n Ensure that the email receives the test email.\n\n Generating a new Horizon Application Secret\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $/opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Akka_Play ':\n\n In the Akka_Play menu, select ' SECRET ':\n\n Validate the new Horizon Application Secret:\n\n The Horizon configuration is updated:\n\n JVM Configuration\n\n Horizon allows you to configure the xms (minimum memory allocation pool) and xmx (maximum memory allocation pool) parameters of the JVM running Horizon using the configuration tool.\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the configuration menu, select ' Horizon ':\n\n In the Horizon configuration menu, Select ' JVM ':\n\n Specify the 2048 for xms and 3072 for xmx parameters and select ' OK ':\n\n The new JVM parameters are configured:\n\n MongoDB URI Configuration\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select Horizon :\n\n In the Horizon configuration menu, Select MONGODB_URI :\n\n Specify the MongoDB URI to target your MongoDB instance:\n\n Horizon is installed to target a local MongoDB instance by default.\n\n If you use an external MongoDB (such as MongoDB Atlas Database or dedicated On-premises database) instance:\n\n Create a user with \"read/write\" permissions on your MongoDB instance;\n\n Create a replicaSet if using a MongoDB cluster;\n\n Specify a MongoDB URI that does match your context.\n\n External MongoDB database URI syntax:\n mongodb+srv://<user>:<password>@<Mongo-DB-hostname>:<Mongo-DB-Port>/horizon\n\n External MongoDB cluster of databases URI syntax:\n mongodb+srv://<user>:<password>@<Mongo-DB-hostname-1>,<Mongo-DB-hostname-2>:<Mongo-DB-Port>/horizon?replicaSet=<Horizon-ReplicaSet-Name>&authSource=admin\n\n The MongoURI is configured:\n\n Horizon Hostname Configuration\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon configuration menu, select HORIZON_HOSTNAME :\n\n Specify the DNS FQDN by which Horizon will be accessed:\n\n The Horizon Hostname is configured:\n\n Generating an event seal secret\n\n Horizon will generate functional events when using the software.\n\n These events are typically signed and chained to ensure their integrity. Therefore, you must specify a sealing secret for this feature to work correctly.\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon menu, select ' HORIZON_SEAL_SECRET ':\n\n Validate the new event seal secret:\n\n The event seal secret is now configured:\n\n Installing the Horizon license\n\n You should have been provided with a ' horizon.lic ' file. This file is a license file and indicates:\n\n The horizon entitled module(s)\n\n The limitation in terms of holder per module if any\n\n A end of support date\n\n Upload the horizon.lic file through SCP under /tmp/horizon.lic ;\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon configuration menu, Select ' HORIZON_LICENSE ':\n\n Specify the path /tmp/horizon.lic and validate:\n\n The Horizon License is configured:\n\n Restart the horizon service using the following command:\n\n $ systemctl restart horizon\n\n Horizon Vault Key configuration\n\n Horizon stored sensitive data in a secure way using encryption.\n\n Horizon masterkey can be derived from:\n\n Software key;\n\n HSM stored key using (PKCS#11 compatible HSMs are supported);\n\n Azure Key Vault stored key;\n\n Hashicorp vault stored key;\n\n FCMS vault stored key.\n\n Please refer to the proper section according to your setup.\n\n Horizon SSV key Configuration (Software)\n\nThis section must not be followed if you use another vault than the default one.\n\n Access the server through SSH with an account with administrative privileges;\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' Horizon ':\n\n In the Horizon configuration menu, Select ' HORIZON_SSV_KEY ':\n\n Specify the master key that will be used:\n\n Horizon masterkey is configured:\n\n Restart the horizon service using the following command:\n\n $ systemctl restart horizon\n\n HSM vault Configuration\n\n Horizon supports PKCS#11 compatible HSM vaults .\n\nThis section must not be followed if you use another vault than the HSM vault.\n\n HSM middleware should be properly installed and HSM slot initialization should be done using the tools provided by the HSM provider.\n\"horizon\" linux user should be member of the proper HSM linux management group to perform cryptographic operations ('nfast' for nCipher nShield HSM or 'hsmusers' for Luna HSM for example).\n\n Access the server through SSH with an account with administrative privileges;\n\n Create a vaults.conf configuration file in /opt/horizon/etc/conf.d directory with the following content to configure the HSM vault:\n\n default {\n module_path = \"\"\n slot_id = \"\"\n pin = \"\"\n label = \"\"\n allow_master_key_gen = true\n}\n\n module_path : The path to the PKCS#11 library (string between double quotes);\n\n slot_id : ID of the Slot on the PKCS#11 Module (string between double quotes);\n\n pin : The PIN used to authenticate to your HSM slot (string between double quotes);\n\n label : Label of key (string between double quotes);\n\n allow_master_key_gen : Allow the masterkey to be generated by Horizon if not found in the slot.\n\n Set the permissions using the following commands:\n\n $ chown horizon:horizon /opt/horizon/etc/conf.d/vaults.conf\n\n Restart the horizon service using the following command:\n\n $ systemctl restart horizon\n\n At the end of the installation procedure:\n\n Set allow_master_key_gen value to false .\n\n Restart the horizon service.\n\n Installing Horizon on a cluster of servers\n\nThis section must not be followed if you plan on deploying Horizon in standalone mode (vs cluster mode).\nWARNING: This section does not explain how to install Horizon on a Kubernetes cluster. Please refer to the dedicated section.\n\n In the main menu, select ' Akka_Play ':\n\n In the Akka_Play menu, select ' AKKA_HA ':\n\n In this menu, specify either the IP address or the DNS name for each server that will be running Horizon on this cluster, as well as the local node index (the number of the node that you are configuring at that moment).\n\n Note that the local node index must match the Node Hostname parameter:\n\n Save your changes from the menu.\n\n The High Availability mode is now configured on the current node:\n\n You must now configure your other nodes, but because they belong to the same cluster they need to share the same secret, the same secret seal event, the same hostname and the same database .\nIn order to be able to do that, you need to copy the configuration file that was generated by the horizon-config app, named /etc/default/horizon and paste it on each one of your nodes;\n\n Then on each other node, run the Horizon Configuration utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the Akka_Play menu, select ' AKKA_HA ':\n\n Here, you need to change the local node index to match the hostname of the node that you are configuring:\n\nYou will need to import the Horizon licence file on each node manually, following the guidelines of section Installing the Horizon license .\n\n Additionally, on each node, you will need to open the ports used for Akka_HA and Akka_MGMT, which are by default 25520 and 8558:\n\n $ firewall-cmd --permanent --add-port=25520/tcp\n$ firewall-cmd --permanent --add-port=8558/tcp\n\n Reload the firewall configuration with:\n\n $ systemctl restart firewalld\n\n Restart the Horizon service on each one of the nodes:\n\n $ systemctl restart horizon\n\n Configure the Firewall\n Server Authentication Certificate", - "keywords": [ - "initial", - "configuration", - "install-guide", - "install-guide/iaas/setup/horizon", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:setup:nginx", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Server Authentication Certificate", - "section": "install-guide", - "slug": "install-guide/iaas/setup/nginx", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/setup/nginx.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/iaas/setup/nginx.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Configuration", - "Server Authentication Certificate" - ], - "summary": "Server Authentication Certificate Issuing a Certificate Request (PKCS#10) Access the server through SSH with an account with administrative privileges. Run the Horizon Configuration Utility with the following command: $ /opt/horizon/sbin/ho", - "content": "Server Authentication Certificate\n\n Issuing a Certificate Request (PKCS#10)\n\n Access the server through SSH with an account with administrative privileges.\n\n Run the Horizon Configuration Utility with the following command:\n\n $ /opt/horizon/sbin/horizon-config\n\n In the main menu, select ' NGINX ':\n\n In the NGINX menu, select ' CSR ':\n\n Specify the DNS Name of the Horizon server (by default, the config script takes the Horizon hostname if defined or the local machine hostname otherwise):\n\n The certificate request is generated and available under /etc/nginx/ssl/horizon.csr.new :\n\n Sign the certificate request using your PKI.\n\n Installing a Server Certificate\n\n Upload the generated server certificate on the Horizon server under /tmp/horizon.pem through SCP;\n\n In the NGINX configuration menu, select ' CRT ':\n\n Specify the path /tmp/horizon.pem and validate:\n\n The server certificate is successfully installed:\n\n Installing the Server Certificate Trust Chain\n\n Upload the server certificate trust chain (the concatenation of the Certificate Authority certificates in PEM format) on the Horizon server under /tmp/server.bundle through SCP;\n\n In the NGINX configuration menu, select ' TC ':\n\n Specify the path /tmp/server.bundle and validate:\n\n The server bundle is successfully installed:\n\n Verify the NGINX configuration with the following command:\n\n $ nginx -t\n\n Restart the NGINX service with the following command:\n\n $ systemctl restart nginx\n\n Initial Configuration\n Startup & login", - "keywords": [ - "server", - "authentication", - "certificate", - "install-guide", - "install-guide/iaas/setup/nginx", - "horizon", - "installation", - "installing", - "on", - "centos/rhel", - "configuration" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:uninstall", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Uninstallation", - "section": "install-guide", - "slug": "install-guide/iaas/uninstall", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/uninstall.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/uninstallation.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Uninstallation" - ], - "summary": "Uninstallation Before uninstalling, please make sure that you have a proper backup of the Horizon component . Once uninstalled, all the Horizon data will be irremediably lost ! Uninstalling Horizon consists in uninstalling: The Horizon serv", - "content": "Uninstallation\n\nBefore uninstalling, please make sure that you have a proper backup of the Horizon component . Once uninstalled, all the Horizon data will be irremediably lost !\n\n Uninstalling Horizon consists in uninstalling:\n\n The Horizon service;\n\n The MongoDB service;\n\n The NGINX service.\n\n Uninstalling Horizon\n\n Access the server through SSH with an account with administrative privileges.\n\n Uninstall Horizon with the following commands:\n\n $ systemctl stop horizon\n $ yum remove horizon\n $ rm -rf /opt/horizon\n $ rm -rf /var/log/horizon\n $ rm -f /etc/default/horizon\n\n Uninstalling NGINX\n\n Access the server through SSH with an account with administrative privileges.\n\n Uninstall NGINX with the following commands:\n\n $ systemctl stop nginx\n $ yum remove nginx\n $ rm -rf /etc/nginx\n $ rm -rf /var/log/nginx\n\n Uninstalling MongoDB\n\n Access the server through SSH with an account with administrative privileges.\n\n Uninstall MongoDB with the following commands:\n\n $ systemctl stop mongod\n $ rpm -qa | grep -i mongo | xargs rpm -e\n $ rm -rf /var/log/mongodb\n $ rm -rf /var/lib/mongodb\n\n Backup and Restore\n Installation", - "keywords": [ - "uninstallation", - "install-guide", - "install-guide/iaas/uninstall", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:upgrade:2.1.0", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Upgrading from a version prior to 2.1.0", - "section": "install-guide", - "slug": "install-guide/iaas/upgrade/2.1.0", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/upgrade/2.1.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.6/install-guide/iaas/upgrade/2.1.0.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Upgrade", - "Upgrading from a version prior to 2.1.0" - ], - "summary": "Upgrading from a version prior to 2.1.0 These instructions are specific to the 2.1.0 version, and should be followed if you upgrade from a version prior to 2.1.0 to any version greater or equal to 2.1.0. These steps should be followed in ad", - "content": "Upgrading from a version prior to 2.1.0\n\n These instructions are specific to the 2.1.0 version, and should be followed if you upgrade from a version prior to 2.1.0 to any version greater or equal to 2.1.0.\n\n These steps should be followed in addition to the common upgrade procedure found in the standard upgrade protocol . None of these steps are automated by horizon-upgrade .\n\n Setting an event seal secret\n\n You must manually create an entry to pass an event seal secret to Horizon in the /etc/default/horizon file. horizon-config won’t do that automatically.\n\n To do so, open the /etc/default/horizon file with a text editor:\n\n $ vi /etc/default/horizon\n\n And add a new line under the Horizon variables section:\n\n # Horizon variables\nHORIZON_NOTIFICATION_SMTP_HOST=127.0.0.1\nHORIZON_HOSTNAME=\nHORIZON_DEFAULT_SSV_KEY=\nHORIZON_EVENT_SEAL_SECRET=changeme # <- this one\n\n Then, near the end of the file, after the # Setting Horizon Mongo DB uri section, create a new section for the event seal secret:\n\n # Setting the Horizon event seal secret\nJAVA_OPTS=\"$JAVA_OPTS -Dhorizon.event.seal.secret=${HORIZON_EVENT_SEAL_SECRET}\"\n\n Horizon won’t boot if the HORIZON_EVENT_SEAL_SECRET is set to changeme . Therefore, you should set your secret to something hard to guess.\nRefer to the Initial Configuration guide to learn how to generate a seal secret with horizon-config .\n\n Standard Upgrade\n Backup and Restore", - "keywords": [ - "upgrading", - "from", - "version", - "prior", - "to", - "install-guide", - "install-guide/iaas/upgrade/2", - "horizon", - "installation", - "installing", - "on", - "centos/rhel", - "upgrade" - ] - }, - { - "page_id": "horizon:2.4:install-guide:iaas:upgrade:upgrade", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Standard Upgrade", - "section": "install-guide", - "slug": "install-guide/iaas/upgrade/upgrade", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/iaas/upgrade/upgrade.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.6/install-guide/iaas/upgrade/upgrade.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on CentOS/RHEL", - "Upgrade", - "Standard Upgrade" - ], - "summary": "Standard Upgrade The current instructions refer to the standard upgrade procedure. Additional steps might be required, please refer to release notes. Upgrade the horizon installation You must retrieve the latest Horizon RPM from the EverTru", - "content": "Standard Upgrade\n\n The current instructions refer to the standard upgrade procedure.\nAdditional steps might be required, please refer to release notes.\n\n Upgrade the horizon installation\n\n You must retrieve the latest Horizon RPM from the EverTrust repository manually using the user credentials you were provided.\n\n Access the server through SSH with an account with administrative privileges.\n\n Install the Horizon package with the following command:\n\n $ yum install horizon-2.4.X-1.noarch.rpm\n\n Upgrade the database schema\n\n Some Horizon versions require that you run migration scripts against your database.\nSince version 2.1.0, Horizon comes bundled with an horizon-upgrade script that handles this migration logic.\n\n Therefore, after each upgrade, you should run horizon-upgrade to check whether new migrations should be run.\n\nSince 2.4.0, horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n Access the server through SSH with an account with administrative privileges.\n\n Run the following command:\n\n $ /opt/horizon/sbin/horizon-upgrade -t <target version>\n\n In most cases, horizon-upgrade can detect the version you’re upgrading from by checking the database. However, when upgrading from version prior to 2.1.0, you will encounter the following error:\n\n *** Unable to infer the source version from your database. Specify it explicitly with the -s flag. ***\n\n You’ll have to explicitly tell horizon-upgrade which version you are upgrading from. To do that, simply set the source version explicitly with the -s flag:\n\n $ /opt/horizon/sbin/horizon-upgrade -t <target version> -s <source version>\n\n Similarly, horizon-upgrade will try to use the MongoDB URI that was configured by the Horizon configuration utility. If it fails to auto-detect your database URI or you wish to migrate another database, specify the URI explicitly using the -m flag:\n\n $ /opt/horizon/sbin/horizon-upgrade -t <target version> -m \"<mongo uri>\"\n\n The upgrade script requires a MongoDB client to connect to your database (either mongo or mongosh ). If no client is installed on the host where Horizon is running, consider installing the standalone mongosh client or running the upgrade script from another host that has access to the database.\n\n Startup & login\n Upgrading from a version prior to 2.1.0", - "keywords": [ - "standard", - "upgrade", - "install-guide", - "install-guide/iaas/upgrade/upgrade", - "horizon", - "installation", - "installing", - "on", - "centos/rhel" - ] - }, - { - "page_id": "horizon:2.4:install-guide:introduction", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Introduction", - "section": "install-guide", - "slug": "install-guide/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/introduction.html", - "breadcrumbs": ["Horizon", "Installation", "Introduction"], - "summary": "Introduction Description Horizon is EverTrust Certificate lifecycle management solution. This document is an installation procedure detailing how to install and bootstrap Horizon server on your infrastructure. It does not describe how to co", - "content": "Introduction\n\n Description\n\n Horizon is EverTrust Certificate lifecycle management solution. This document is an installation procedure detailing how to install and bootstrap Horizon server on your infrastructure. It does not describe how to configure and operate a Horizon instance. Please refer to the administration guide for administration related tasks.\n\n Prerequisites\n\n Choose an installation method\n\n We offer two installation modes:\n\n A package-based installation on a server running CentOS/RHEL 7.x/8.x x64\n\n A cloud-native installation using Kubernetes\n\n Depending on your needs, you’ll have to choose the solution that fits your use cases the best. Reach out to our support team to get suggestions on how to deploy on your infrastructure.\n\n Gathering your credentials\n\n Both methods require that you download the binaries of the Horizon software from our software repository . The access to this repository is protected by username and password, which you should have got from our tech team. If you don’t, you won’t be able to continue with the installation. Email us to get your credentials, and come back to this step.\n\n Pre-requisites", - "keywords": [ - "introduction", - "install-guide", - "install-guide/introduction", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.4:install-guide:k8s:access", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Startup & login", - "section": "install-guide", - "slug": "install-guide/k8s/access", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/k8s/access.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/k8s/access.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Startup & login" - ], - "summary": "Startup & login Accessing Horizon Once the Horizon deployment is up and running, you can expose it to access the web UI and start configuring the instance. By default, Horizon will expose a plain HTTP endpoint on port 9000 and an HTTPS endp", - "content": "Startup & login\n\n Accessing Horizon\n\n Once the Horizon deployment is up and running, you can expose it to access the web UI and start configuring the instance.\n\n By default, Horizon will expose a plain HTTP endpoint on port 9000 and an HTTPS endpoint on port 9443 (serving a self-signed certificate, unless configured otherwise).\n\n Expose locally with a port forward\n\n Recommended for testing and debugging, this is the fastest way to connect to your Horizon instance. The idea is to map a local port of your host computer to the remote port of the Horizon container.\n\n To do so, run:\n\n kubectl port-forward <horizon pod name> 9000:9000\n\n Horizon will then be available on http://localhost:9000 . A more in-depth tutorial on port forwarding can be found here .\n\n Expose through an ingress controller\n\n When an ingress controller is configured in your cluster, this is the proper way to access Horizon. To deploy an ingress alongside Horizon, set the ingress.enabled key to true in the Helm Chart’s values override.\n\n Logging in for the first time\n\n Upon the first startup, an administrator account will be generated for you to log in.\nThis account has the administrator username and a random password stored on disk, on the master Horizon pod.\n\n To find out the randomly generated password, run:\n\n kubectl exec $(kubectl get pods -n <namespace> -l \"app.kubernetes.io/name=horizon\" --sort-by={.status.podIP} -o jsonpath=\"{.items[0].metadata.name}\") -n <namespace> -- /bin/sh -c \"cat /tmp/tmp.*/adminPassword\"\n\nIt is highly recommended to create a dedicated administration account and delete the default one, or at least modify the default administrator password.\n\n Production checklist\n Upgrade", - "keywords": [ - "startup", - "login", - "install-guide", - "install-guide/k8s/access", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.4:install-guide:k8s:advanced", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Advanced usage", - "section": "install-guide", - "slug": "install-guide/k8s/advanced", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/k8s/advanced.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/k8s/advanced.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Advanced usage" - ], - "summary": "Advanced usage Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes. You may find some of them below. Running behind a Docker registry proxy If your installation environment requi", - "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes. You may find some of them below.\n\n Running behind a Docker registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images.\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use a CRD (Custom Resource Definition) named Lease ( akka.io/v1/leases ). We strongly recommend that you use this mechanism, however it implies that you have the necessary permissions to install CRDs onto your server. In case you don’t, the feature can be disabled by passing the --skip-crds flag to the Helm command when installing the chart, and setting the leases.enabled key to false .\nIf you want to manually install the CRD, you can check the crds/leases.yml file.\n\n Injecting extra configuration\n\n Extra Horizon configuration can be injected to the bundled application.conf file to modify low-level behavior of Horizon. This should be used carefully as it may cause things to break. To do so, just mount a folder in the Horizon container at /opt/horizon/etc/ containing an application.conf file.\n\n This can be done with the following edits to your values.yaml file:\n\n extraVolumes:\n - name: additional-config\n configMap:\n name: additional-config\n\nextraVolumeMounts:\n - name: additional-config\n mountPath: /opt/horizon/etc\n\n Where the additional-config configmap contains a single key with your custom configuration:\n\n apiVersion: v1\nkind: ConfigMap\ndata:\n application.conf: |-\n play.server.http.port = 9999\n\n Extra configurations are included at the end of the config file, overriding any previously set config value.\n\n Uninstallation\n Installing on Openshift", - "keywords": [ - "advanced", - "usage", - "install-guide", - "install-guide/k8s/advanced", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.4:install-guide:k8s:installation", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Installation", - "section": "install-guide", - "slug": "install-guide/k8s/installation", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/k8s/installation.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/k8s/installation.html", - "breadcrumbs": ["Horizon", "Installation", "Installing on Kubernetes"], - "summary": "Installation Concepts overview In Kubernetes, applications are deployed onto Pods , which represents a running version of a containerized application. Pods are grouped by Deployments , which represent a set of Pods running the same applicat", - "content": "Installation\n\n Concepts overview\n\n In Kubernetes, applications are deployed onto Pods , which represents a running version of a containerized application. Pods are grouped by Deployments , which represent a set of Pods running the same application. For instance, should you need to run Horizon in high availability mode, your deployment will contain 3 pods or more. Applications running in Pods are made accessible by a Service , which grants a set of Pods an IP address (which can either be internal to the cluster or accessible on the public Internet through a Load Balancer).\n\n The recommended way of installing on Horizon is through the Horizon’s Helm Chart. Helm is a package manager for Kubernetes that will generate Kubernetes resources necessary to deploy Horizon onto your cluster. The official Helm Chart will generate a deployment of one or more Pods running Horizon on your cluster.\n\n Setting up Helm repository\n\n Now that the application secrets are configured, add the EverTrust Helm repository to your machine:\n\n $ helm repo add evertrust https://repo.evertrust.io/repository/charts\n\n Verify that you have access to the Chart:\n\n $ helm search repo evertrust/horizon\nNAME CHART VERSION\tAPP VERSION\tDESCRIPTION\nevertrust/horizon 0.8.0 2.4.0 EverTrust Horizon Helm chart\n\n Configuring the namespace\n\n For isolation purposes, we strongly recommend that you create a dedicated namespace for Horizon :\n\n $ kubectl create namespace horizon\n\n The namespace should be empty. In order to run Horizon, you’ll need to create two secrets in that namespace:\n\n A license secret containing your Horizon license file\n\n An image pull secret, allowing Kubernetes to authenticate to the EverTrust’s container repository\n\n Creating the license secret\n\n You should have a license file for your Horizon installation, most probably named horizon.lic . To convert this file to a Kubernetes secret, run:\n\n $ kubectl create secret generic horizon-license \\\n --from-file=license=\"<path to your license file>\" \\\n --namespace horizon\n\n Creating the image pull secret\n\n Next, you should configure Kubernetes to authenticate to the EverTrust repository using your credentials. They are necessary to pull the Horizon docker image, you should have received them upon purchase. Get your username and password and create the secret:\n\n $ kubectl create secret docker-registry evertrust-registry \\\n --docker-server=registry.evertrust.io \\\n --docker-username=\"<your username>\" \\\n --docker-password=\"<your password>\" \\\n --namespace horizon\n\n Configuring the chart\n\n You’ll next need to override the defaults values.yaml file of the Helm Chart to reference the secrets that we’ve created. We’ll provide a minimal configuration for demonstration purposes, but please do follow our production setup guide before deploying for production.\n\n Create a override-values.yaml file somewhere and paste this into the file:\n\n image:\n pullSecrets:\n - evertrust-registry\n\nlicense:\n secretName: horizon-license\n secretKey: license\n\n To finish Horizon’s installation, simply run the following command:\n\n $ helm install horizon evertrust/horizon -f override-values.yaml -n horizon\n\n Please allow a few minutes for the Horizon instance to boot up. You are now ready to go on with the Startup & login .\nThis instance will allow you to test out if Horizon is working correctly on your cluster. However, this installation is not production-ready. Follow our Production checklist to make sure your instance is fit to run in your production environment.\n\n Uninstallation\n Production checklist", - "keywords": [ - "installation", - "install-guide", - "install-guide/k8s/installation", - "horizon", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.4:install-guide:k8s:production", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Production checklist", - "section": "install-guide", - "slug": "install-guide/k8s/production", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/k8s/production.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/k8s/production.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Production checklist" - ], - "summary": "Production checklist Even though the Helm Chart makes installing Horizon a breeze, you’ll still have to set up a few things to make Horizon resilient enough to operate in a production environment. Operating the database All persistent data ", - "content": "Production checklist\n\n Even though the Helm Chart makes installing Horizon a breeze, you’ll still have to set up a few things to make Horizon resilient enough to operate in a production environment.\n\n Operating the database\n\n All persistent data used by Horizon is stored in the underlying MongoDB database.\nTherefore, the database should be operated securely and backed up regularly.\n\n When installing the chart, you face multiple options regarding your database:\n\n By default, a local MongoDB standalone instance will be spawned in your cluster, using the bitnami/mongodb chart.\nNo additional configuration is required but it is not production ready out of the box.\nYou can configure the chart as you would normally below the mongodb key:\n\n mongodb:\n architecture: replicaset\n # Any other YAML value from the chart docs\n\n If you want to use an existing MongoDB instance, provide the externalDatabase.uri value.\nThe URI should be treated as a secret as it must include credentials:\n\n externalDatabase:\n uri:\n valueFrom:\n secretKeyRef:\n name: <secret name>\n key: <secret key>\n\n The chart doesn’t manage the database.\nYou are still in charge of making sure that the database is correctly backed up.\nYou could either back up manually using mongodump or use a managed service such as MongoDB Atlas , which will take care of the backups for you.\n\n Managing secrets\n\n Storing secrets is a crucial part of your Horizon installation.\nOn cloud-native installations like on Kubernetes, we recommend using SSV (Secure Software Vault) to encrypt sensitive data: a master passphrase will be used to encrypt and decrypt data before they enter the database.\nAlongside with other application secrets like your MongoDB URI (containing your credentials or certificate).\nWe recommend that you create Kubernetes secrets beforehand or inject them directly into the pod.\n\n Values that should be treated as secrets in this chart are:\n\n Name\n Description\n Impact on loss\n\n vaults.*.master_password\n\n SSV password used to encrypt sensitive data in database.\n\n Highest impact: database would be unusable\n\n events.secret\n\n Secret used to sign and chain events.\n\n Moderate impact: events integrity would be unverifiable\n\n externalDatabase.uri\n\n External database URI, containing a username and password.\n\n Low impact: reset the MongoDB password\n\n appSecret\n\n Application secret use to encrypt session data.\n\n Low impact: sessions would be reset\n\n mailer.password\n\n SMTP server password\n\n Low impact: reset the SMTP password\n\n For each of these values, either:\n\n leave the field empty, so that a secret will be automatically generated.\n\n derive the secret value from an existing Kubernetes secret:\n\n appSecret:\n valueFrom:\n secretKeyRef:\n name: <secret name>\n key: <secret key>\n\nAlways store auto-generated secrets in a safe place after they’re generated.\nIf you ever uninstall your Helm chart, the deletion of the SSV secret will lead to the impossibility of recovering most of your data.\n\n High availability\n\n By default, the chart will configure a single-pod deployment.\nThis deployment method is fine for testing but not ready for production as a single failure could take down the entire application.\nInstead, we recommend that you set up a Horizon cluster using at least 3 pods.\n\n In order to do that, configure an horizontalAutoscaler in your override-values.yaml file:\n\n horizontalAutoscaler:\n enabled: true\n minReplicas: 3\n maxReplicas: 3\n\nUse nodeAffinity to spread your Horizon cluster Pods among multiple nodes in different availability zones to reduce the risk of Single Point of Failure.\n\n Configuring ingresses\n\n The recommended way to access Horizon is behind a reverse proxy, known in the Kubernetes world as \"ingress controllers\".\nHowever, Horizon requires that the reverse proxy in front of it (that also terminates the TLS connection) requests certificate client authentication (also known as mTLS).\n\n To create an ingress upon installation, simply set the following keys in your override-values.yaml file:\n\n ingress:\n enabled: true\n hostname: horizon.lab\n tls: true\n\n Identify CAs which will require certificate authentication\n\n You’ll need to gather a list of CAs that will emit certificates which will be able to authenticate to Horizon.\nTo identify them, ask yourself whether the certificates signed by these CAs will:\n\n renew using the EST protocol (used by the Horizon Client)\n\n be used to authenticate users to Horizon (either through API or via the UI)\n\n be used to authenticate the WinHorizon component (in an Active Directory environment)\n\n Other use-cases might also require you to authenticate with a client certificate.\n\n Configure your ingress to require a client certificate\n\n Configuration for mTLS depends on the ingress controller that you use.\nThe following ingress controllers are officially supported by EVERTRUST, and we strongly advise to use one of them with Horizon.\nHowever, almost any ingress controller can be configured to correctly request client certificates manually.\n\n ingress-nginx\n\n The Horizon Helm Chart supports autoconfiguring ingress-nginx .\nTo enable client certificate authentication, simply set the following values in the values-override.yaml file:\n\n ingress:\n enabled: true\n type: nginx\n clientCertificateAuth: true\n hostname: horizon.lab\n tls: true\n\n Skip to the Ensure certificate authentication is effective section to test your configuration.\n\n ingress-nginx doesn’t require a list of CAs trusted for client authentication, so any certificate may be submitted by a connecting client.\nIf you wish to specify a list of CAs, disable autoconfiguration and manually configure your ingress using annotations following the ingress-nginx documentation .\n\n Traefik\n\n The Horizon Helm Chart supports autoconfiguring Traefik.\nTo enable client certificate authentication, simply set the following values in the values-override.yaml file:\n\n ingress:\n enabled: true\n type: traefik\n clientCertificateAuth: true\n hostname: horizon.lab\n tls: true\n\n Skip to the Ensure certificate authentication is effective section to test your configuration.\n\nTraefik doesn’t require a list of CAs trusted for client authentication, so any certificate may be submitted by a connecting client.\nIf you wish to specify a list of CAs, disable autoconfiguration and manually configure your ingress using annotations following the Traefik documentation .\n\n Other ingress controllers\n\n If you do not wish or cannot use autoconfiguration, you should ensure your ingress controller is correctly configured to enable all Horizon features.\n\n When requiring client certificates for authentication, the web server should not perform checks to validate that the certificate is signed by a trusted CA.\nInstead, the certificate should be sent to Horizon through a request header, base64-encoded.\nThe header name used can be controlled using the clientCertificateHeader .\n\n Some endpoints should not be server over HTTPS, in particular those used for SCEP enrollment.\nYou may want to create an HTTP-only ingress for serving paths prefixed by /scep and /certsrv , and prevent those from redirecting to HTTPS.\n\nThe cert-auth-proxy component, maintained by EverTrust, can be used to add client certificate authentication to any ingress controller which supports passthrough TLS.\n\n Ensure certificate authentication is effective\n\n To ensure that Horizon can properly decode certificates being sent by clients, get a certificate from a CA configured for client authentication in a cert.pem file and its associated key in a key.pem file.\n\n Then, run the following curl command :\n\n $ curl -k --cert cert.pem --key key.pem https://<Horizon URL>/api/v1/security/principals/self\n\n If Horizon returns an error, or states that the principal is not authenticated (through a 204 HTTP code), then certificate authentication is incorrectly configured.\n\n Instead, information about the certificate should be returned in the principal key :\n\n {\n \"identity\": {\n \"identifier\": \"CN=User, O=EVERTRUST, C=FR\", (1)\n \"name\": \"User\",\n \"identityProviderType\": \"X509\", (2)\n \"identityProviderName\": \"EVERTRUST CA\"\n },\n \"permissions\": [],\n \"roles\": null,\n \"teams\": null,\n \"preferences\": null,\n \"customDashboards\": null\n}\n\n 1\n The DN of the certificate is used as the principal identifier.\n\n 2\n The identity provider is of type X509.\n\n Installation\n Startup & login", - "keywords": [ - "production", - "checklist", - "install-guide", - "install-guide/k8s/production", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.4:install-guide:k8s:uninstall", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Uninstallation", - "section": "install-guide", - "slug": "install-guide/k8s/uninstall", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/k8s/uninstall.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/uninstallation.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Uninstallation" - ], - "summary": "Uninstallation To uninstall Horizon from your cluster, simply run: $ helm uninstall horizon -n horizon This will uninstall Horizon. If you installed a local MongoDB instance through the Horizon’s chart, it will also be uninstalled, meaning ", - "content": "Uninstallation\n\n To uninstall Horizon from your cluster, simply run:\n\n $ helm uninstall horizon -n horizon\n\n This will uninstall Horizon. If you installed a local MongoDB instance through the Horizon’s chart, it will also be uninstalled, meaning you’ll lose all data from the instance.\n\nBefore uninstalling Horizon, if you wish to keep your database, please back up your application secrets (in particular the SSV secret). Without it, you won’t be able to decrypt your database and it will become useless.\n\n Upgrade\n Advanced usage", - "keywords": [ - "uninstallation", - "install-guide", - "install-guide/k8s/uninstall", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.4:install-guide:k8s:upgrade", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Upgrade", - "section": "install-guide", - "slug": "install-guide/k8s/upgrade", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/k8s/upgrade.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/upgrade.html", - "breadcrumbs": [ - "Horizon", - "Installation", - "Installing on Kubernetes", - "Upgrade" - ], - "summary": "Upgrade We recommended that you only change values you need to customize in your values.yml file to ensure smooth upgrading. Always check the upgrading instructions between chart versions. Upgrading the chart When upgrading Horizon, you’ll ", - "content": "Upgrade\n\n We recommended that you only change values you need to customize in your values.yml file to ensure smooth upgrading.\nAlways check the upgrading instructions between chart versions.\n\n Upgrading the chart\n\n When upgrading Horizon, you’ll need to pull the latest version of the chart:\n\n $ helm repo update evertrust\n\n Verify that you now have the latest version of Horizon (through the App version column):\n\n $ helm search repo evertrust/horizon\nNAME CHART VERSION\tAPP VERSION\tDESCRIPTION\nevertrust/horizon 0.8.0 2.4.0 EverTrust Horizon Helm chart\n\n Launch an upgrade by specifying the new version of the chart through the --version flag in your command:\n\n $ helm upgrade <horizon> evertrust/horizon \\\n --values override-values.yaml \\\n --version 0.8.0\n\n Upgrading the database\n\n Horizon requires that you run a script called horizon-upgrade before installing a newer version of Horizon. This script will migrate the database schemas for compatibility with the new version. You have two options for running that script : either let Helm do it automatically or run the script manually from any computer that has Docker.\n\n Automatic database upgrade\n\n By default, the chart will automatically create a Job that runs an upgrade script when it detects that the Horizon version has changed between two releases. If the upgrade job fails to run, check the job’s pod logs. When upgrading from an old version of Horizon, you may need to explicitly specify the version you’re upgrading from using the upgrade.from key. The created pod will pull an image named horizon-upgrade:2.4.x , so make sure this image will be available to the cluster when upgrading.\n\n Should you wish to disable the automatic upgrade mechanism, just set the upgrade.enabled key to false .\n\nBefore upgrading to specific chart version, thoroughly read any Specific chart upgrade instructions for your version.\n\n Manual database upgrade\n\n If for some reason, you need to manually run the upgrade script, you can use the dockerized version of the script provided that your host device has access to the Horizon’s MongoDB database.\n\n You can then run the script through Docker :\n\n $ docker run -it --rm registry.evertrust.io/horizon-upgrade:2.4.x \\\n -m <mongo uri> \\\n -t <target version> \\\n -s <source version> # This is required when upgrading from an older version of Horizon\n\n Specific chart upgrade instructions\n\n Upgrading to 0.3.0\n\n Loggers are now configured with an array instead of a dictionary. Check the values.yaml format and update your override values.yaml accordingly.\n\n The init database parameters ( initDatabase , initUsername and initPassword ) have been renamed and moved to mongodb.horizon .\n\n Upgrading to 0.5.0\n\n The ingress definition has changed. The rules and tls keys have been removed in favor of a more user-friendly hostname that will autoconfigure the ingress rules, and a boolean tls key that will enable TLS on that ingress. Check the Ingress section.\n\n Startup & login\n Uninstallation", - "keywords": [ - "upgrade", - "install-guide", - "install-guide/k8s/upgrade", - "horizon", - "installation", - "installing", - "on", - "kubernetes" - ] - }, - { - "page_id": "horizon:2.4:install-guide:openshift", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Installing on Openshift", - "section": "install-guide", - "slug": "install-guide/openshift", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/openshift.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/openshift.html", - "breadcrumbs": ["Horizon", "Installation", "Installing on Openshift"], - "summary": "Installing on Openshift Installing Horizon on Openshift is very similar to installing on Kubernetes. The main difference is that you need to use the oc command instead of kubectl . For that reason, you should follow the Kubernetes installat", - "content": "Installing on Openshift\n\n Installing Horizon on Openshift is very similar to installing on Kubernetes.\nThe main difference is that you need to use the oc command instead of kubectl .\nFor that reason, you should follow the Kubernetes installation procedure .\n\n This page details the differences expected between Kubernetes and Openshift.\n\n Security contexts\n\n The default Horizon Helm chart uses the 1001 user to avoid running as root inside the container.\nHowever, on OpenShift, this results in the anyuid SCC being required to run the container.\nSince a random non-root UID will be assigned by OpenShift to the container upon startup, this security measure is unnecessary.\nIt can be safely disabled by adding the following YAML to your values-override.yaml file:\n\n podSecurityContext:\n enabled: false\n\ncontainerSecurityContext:\n enabled: false\n\n If you’re using the built-in database for test purposes, you’ll also need to disable the security context for the database container:\n\n mongodb:\n podSecurityContext:\n enabled: false\n\n containerSecurityContext:\n enabled: false\n\n Leases\n\n In a large cluster, chances are that CRDs cannot be installed by a regular user.\nHowever, Horizon can be configured to rely on leases that are CRDs for clustering.\nSee the dedicated documentation section for more information on how leases work.\n\n Leases can be safely disabled without having a large impact on Horizon reliability.\nThey mostly help in case of a network partition across multiple datacenters or availability zones.\n\n To disable leases, add the following YAML to your values-override.yaml file:\n\n leases:\n enabled: false\n\n Then, when installing the helm chart, add the --skip-crds option to ensure that the leases CRD is not installed.\n\n Router configuration\n\n When exposing Horizon through the OpenShift router, you need to provide Horizon with a way to authenticate client certificates.\nYou have two options to do so:\n\n Install the cert-auth-proxy component as a sidecar of the Horizon pod and use a passthrough route to forward traffic to Horizon. ( recommended )\n\n Configure the router to ask for client certificates and forward traffic to Horizon.\n\n Using cert-auth-proxy\n\n The cert-auth-proxy component is a small proxy that can be used to authenticate client certificates. It is installed as a sidecar container to Horizon, and then referenced in place of Horizon in the OpenShift route or ingress.\nTo install it, add the following YAML to your values-override.yaml file:\n\n clientCertificateHeader: \"X-Forwarded-Tls-Client-Cert\"\n\nsidecars:\n - name: cert-auth-proxy\n image: registry.evertrust.io/cert-auth-proxy:latest\n imagePullPolicy: Never\n ports:\n - name: https-proxy\n containerPort: 8443\n env:\n - name: UPSTREAM\n value: localhost:9000\n volumeMounts:\n - name: horizon-local-tls\n # This mountPath will enable the certificate for the \"horizon.local\" route\n mountPath: /var/cert-auth-proxy/certificates/horizon.local\n\nextraVolumes:\n - name: horizon-local-tls\n secret:\n # This secret must contain a valid TLS certificate for route hostname.\n secretName: horizon.local-tls\n\nservice:\n extraPorts:\n - name: https-proxy\n protocol: TCP\n port: 8443\n targetPort: https-proxy\n\n Then, you can either use the following extra values to override-values.yaml to generate an ingress with a passthrough route:\n\n ingress:\n enabled: true\n annotations:\n route.openshift.io/termination: \"passthrough\"\n extraRules:\n - host: \"horizon.local\"\n http:\n paths:\n - path: /\n pathType: Prefix\n backend:\n service:\n name: horizon\n port:\n name: https-proxy\n extraTls:\n - hosts:\n - \"horizon.local\"\n secretName: horizon.local-tls\n\n If you wish to use the Route resource instead, disable the ingress by setting ingress.enabled to false and manually create the route:\n\n $ oc create route passthrough horizon --service=horizon --port=https-proxy --hostname=horizon.local\n\n Using the router mTLS configuration\n\nThis method is no longer recommended since it requires deploying a specific ingress controller for Horizon purposes. Changing mTLS settings on an ingress controller affects all routes served by this ingress controller.\n\n Follow the Kubernetes ingress controller configuration procedure . Gather all ACs identified in the previous step and create a bundle file containing all of them, called ca-bundle.pem .\n\n Then, follow the Openshift documentation to configure the ingress controller serving Horizon requests to ask for client certificates signed by any of these ACs:\n\n Upload the ACs to the OpenShift cluster in a configmap\n\n $ oc create configmap router-ca-certs-default --from-file=ca-bundle.pem=ca-bundle.pem -n openshift-config\n\n Tell the ingress controller to ask for client certificates\n\n $ oc edit IngressController default -n openshift-ingress-operator\n\n And set the following values:\n\n apiVersion: operator.openshift.io/v1\nkind: IngressController\nmetadata:\n name: default\nnamespace: openshift-ingress-operator\nspec:\n clientTLS:\n clientCertificatePolicy: Optional\n clientCA:\n name: router-ca-certs-default\n\n Then, when installing Horizon through the Chart, set the clientCertificateDefaultParsingType key to the value haproxy (which is what the Openshift ingress controller is based on).\n\nAs of 4.14, Openshift will only download CRLs from the certificates in the ca-bundle.pem chain (inferred from their CRLDPs). This can lead to a TLS handshake failure when authenticating using a client certificate. Introducing a dummy entity certificate in the chain might be required to ensure that the operational CAs CRLs are downloaded by the Openshift ingress controller. See this issue for more information.\n\n Skip to the Ensure certificate authentication is effective section to test your configuration.\n\n Advanced usage\n Running with Docker/Compose", - "keywords": [ - "installing", - "on", - "openshift", - "install-guide", - "install-guide/openshift", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.4:install-guide:troubleshooting", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Troubleshooting", - "section": "install-guide", - "slug": "install-guide/troubleshooting", - "url": "https://docs.evertrust.fr/horizon/2.4/install-guide/troubleshooting.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/troubleshooting.html", - "breadcrumbs": ["Horizon", "Installation", "Troubleshooting"], - "summary": "Troubleshooting Horizon Doctor Horizon Doctor is currently only available for deployments on CentOS/RHEL. To troubleshoot deployments on Kubernetes, use built-in tools like events and logs. Horizon doctor is a tool that performs checks on y", - "content": "Troubleshooting\n\n Horizon Doctor\n\n Horizon Doctor is currently only available for deployments on CentOS/RHEL. To troubleshoot deployments on Kubernetes, use built-in tools like events and logs.\n\n Horizon doctor is a tool that performs checks on your Horizon installation as well as its required dependencies to ensure that everything is configured properly.\nThe tool is targeted towards troubleshooting during installation or update procedures.\nNote that the tool requires root permissions to run.\n\n Performed checks\n\n At the moment, Horizon Doctor checks for:\n\n OS checks\n\n Checks for installed Horizon version, MongoDB version, Java version, Nginx version, OS Version.\n\n If the OS is a RedHat distribution, checks if the RedHat subscription is active\n\n If Mongo is not installed locally, it notices it as an information log\n\n Checks for SELinux 's configuration: throws a warning if it is enabled, says ok if it is on permissive or disabled\n\n Checks for the status of the necessary services: postfix , mongod , nginx and horizon .\n\n If the postfix service is running, tries to connect via a TCP SYN on the port 25 of the relayhost specified in the /etc/postfix/main.cf file and throws an error if it can’t.\n\n Checks how long the Horizon service has been running for.\n\n Checks if there is an NTP service active on the machine and checks if the system clock is synchronized with the NTP service.\n\n Config checks\n\n Checks for existence and permissions of the configuration file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon\n\n Checks for existence and permissions of the licence file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for existence and permissions of the vault file: the permissions are expected to be at least 640 and the file is supposed to belong to horizon:horizon.\n\n Checks for the permission of the Horizon directory (default: /opt/horizon): the permission is expected to be at least 755.\n\n Checks for the existence of the symbolic link for nginx configuration and runs an nginx -t test.\n\n Retrieves the Java heap size parameters that were set for Horizon and throws a warning if the default ones are used (min = 2048 and max = 3072).\n\n Retrieves the Horizon DNS hostname and stores it for a later test (throws an error if it has not been set).\n\n Checks for the Horizon Play Secret and Horizon Event Seal Secret : these are the Horizon application secrets and should be different from default value thus Horizon Doctor throws an error if either of them is equal to the default value ( changeme ).\n\n Retrieves the MongoDB URI (throws a warning if MongoDB is running on localhost; throws an error if MongoDB is running on an external instance but the authSource=admin parameter is missing from the URI).\n\n Parses the Horizon licence file to retrieve its expiration date as well as the licence details (number of holders per category).\n\n Network checks\n\n Runs a MongoDB ping on the URI, then checks for the database used in the URI (throws a warning if the database used is not called horizon ; throws an error if no database is specified in the URI).\n\n Checks for AKKA High Availability settings: if no node hostname is set up, skips the remaining HA checks. If 2 nodes are set up, retrieves which node is running the doctor and checks for the other node. If 3 nodes are set up, retrieves which node is running the doctor and checks for the other 2 nodes.\nThe check runs as:\n\n if curl is installed, runs a curl request on the Node hostname at alive on the management port (default is 8558), and if alive runs another curl request on the Node hostname at /ready on the management port. Both requests should return HTTP/200 if ok, 000 otherwise.\n\n if curl is not installed, uses the built-in Linux TCP socket to run TCP SYN checks on both the HA communication port (default is 25520) and the management port (default is 8558) on the Node hostname.\n\n Checks for firewall configuration . Currently only supports firewalld (RHEL) and a netstat test.\n\n The netstat part will run a netstat command to check if the JVM listening socket is active (listening on port 9000). If netstat is not installed, it will skip this test.\n\n The firewalld part will check if the HTTP and HTTPS services are opened in the firewall and if it detected a HA configuration, it will check if the HA ports (both of them) are allowed through the firewalld. If firewalld is not installed or not active, it will skip this test.\n\n Checks if IPv6 is active in every network interface and throws a warning if it is the case (specifying the interface with IPv6 turned on).\n\n TLS checks\n\n Checks for existence and permissions of the Horizon server certificate file: the permissions are expected to be at least 640 and the file is supposed to belong to the nginx group.\n\n Parses the Horizon server certificate file: it should be constituted of the actual TLS server certificate first, then of every certificate of the trust chain (order being leaf to root). It throws a warning if the certificate is self-signed or raises an error if the trust chain has not been imported. It otherwise tries to reconstitute the certificate trust chain via the openssl verify command, and throws an error if it cannot.\n\n Parses the Horizon server certificate file and checks if the Horizon hostname is present in the SAN DNS names of the certificate, throws an error if it is not there.\n\n Log packing option\n\n If the Horizon doctor is launched with the -l option , it will pack the logs of the last 7 days (in /opt/horizon/var/log ) as well as the startup logs (the /var/log/horizon/horizon.log file) and create a tar archive.\n\n The -l option accepts an optional parameter that should be an integer (1-99) and will pack the logs of the last n days instead, as well as the startup logs.\n\n Note that the Horizon doctor will still perform all of its check; the log packing is done at the very end of the program.\n\n Example of call to pack the logs of the last 7 days:\n\n $ horizon-doctor -l\n\n Example of call to pack the logs of the last 30 days:\n\n $ horizon-doctor -l 30\n\n Saving the doctor’s output\n\n If the Horizon doctor is launched with the -o option , it will perform all of its checks and save the output in the specified file instead of displaying it into the stdout (default is the command line interface).\n\n If you use the option, you must provide a filepath in a writable directory.\n\n Example of call to save the output in a file named horizon-doctor.out instead of the stdout:\n\n $ horizon-doctor -o horizon-doctor.out\n\n Help menu\n\n To display Horizon doctor’s help menu, use the -h option.\n\n Additional checks\n\n Ensure that you are using an up-to-date web browser when trying to access the Horizon web interface.\n\n Ensure that Javascript in turned on in your web browser.\n\n Ensure that your user machine can access the server where Horizon was installed.\n\n If several hostnames have been set up for the Horizon interface, ensure that every single one of them is present in the TLS certificate SAN DNS names.\n\n Running with Docker/Compose\n Introduction", - "keywords": [ - "troubleshooting", - "install-guide", - "install-guide/troubleshooting", - "horizon", - "installation" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.0", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.0 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.0", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.0.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.0.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.0 release notes" - ], - "summary": "Horizon 2.4.0 release notes Here are the release notes for EverTrust Horizon v2.4.0, released on 2023-05-16. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer supp", - "content": "Horizon 2.4.0 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.0, released on 2023-05-16.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [HRZ-404] - Adding support for CRMP Protocol\n\n [HRZ-417] - Implementing rules to grade certificate in accordance with NIST, ANSSI…​\n\n [HRZ-418] - Add Automation policy\n\n [HRZ-478] - Adding support for WCCE Escrow\n\n [HRZ-479] - Rework renew workflow: renew, PoP renew and WebRA Direct renewal\n\n [HRZ-488] - Expose Trust Chains on the Registration Authority interface\n\n [HRZ-628] - Implementing Standard/Expert mode in the Configuration interface (Standard mode → only mandatory fields and simple concepts are displayed / Expert mode → all fields are displayed to do specific setup)\n\n [HRZ-631] - Adding a Crypto decoder tool on the Registration Authority interface\n\n [HRZ-684] - Creating ownership section on request summary\n\n [HRZ-766] - Add trigger results info in a dedicated tab\n\n [HRZ-716] - Implementing suggestions in order for the end-user to choose a value from a whitelist or add a new one\n\n [HRZ-733] - Implementing Custom dashboard for requests\n\n [HRZ-733] - Implementing HRQL expert mode\n\n [HRZ-733] - Implementing Audit request permission\n\n 2. Enhancements\n\n [HRZ-477] - Refactoring the certificate templates and introducing computation rules\n\n [HRZ-662] - Owner can implicitly submit self requests regardless of permissions\n\n [HRZ-706] - Improving displayed message when wrong HCQL/HRQL is submitted\n\n [HRZ-750] - Various UI/UX improvements\n\n [HRZ-1175] - Adding SCEP renewal events\n\n 3. Bug Fixes\n\n [HRZ-624] - An EST challenge could be asked on non challenge profiles\n\n [HRZ-698] - Manage request popup was not hidden when the PKI is very slow to sign certificate\n\n [HRZ-700] - Missing label display names in certificate view\n\n [HRZ-1031] - Deleting an referenced identity provider is not allowed\n\n [HRZ-1231] - Migrating discovered certificates showed unnecessary profiles\n\n 4. Known Defects\n\n [HRZ-1283] - Enrolling a certificate on CertEurope, DigiCert, Entrust, FCMS, GSAtlas, GlobalSign or MetaPKI fails\n\n Horizon 2.4.1 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.1", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.1 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.1", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.1.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.1.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.1 release notes" - ], - "summary": "Horizon 2.4.1 release notes Here are the release notes for EverTrust Horizon v2.4.1, released on 2023-06-01. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer supp", - "content": "Horizon 2.4.1 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.1, released on 2023-06-01.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HRZ-1277] - SCEP challenge was not approved with mandatory non editable contact email with computation rule\n\n [HRZ-1280] - Fields with computation rules bypassed validations in some cases (SANs and Team metadata)\n\n [HRZ-1283] - Invalid enrollment when a PKI connector returns a technical metadata\n\n [HRZ-1293] - Principal information lost when restarting Horizon using OpenID Connect\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.4.2 release notes\n Horizon 2.4.0 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.10", + "page_id": "horizon:2.10:release-notes:2.10.2", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.10 release notes", + "version": "2.10", + "title": "Horizon 2.10.2 release notes", "section": "release-notes", - "slug": "release-notes/2.4.10", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.10.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.10.html", + "slug": "release-notes/2.10.2", + "url": "https://docs.evertrust.fr/horizon/2.10/release-notes/2.10.2.html", + "canonical_url": "https://docs.evertrust.fr/horizon/2.10/release-notes/2.10.2.html", "breadcrumbs": [ "Horizon", "Release notes", - "Horizon 2.4.10 release notes" + "Horizon 2.10.2 release notes" ], - "summary": "Horizon 2.4.10 release notes Here are the release notes for EverTrust Horizon v2.4.10, released on 2023-11-17. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer su", - "content": "Horizon 2.4.10 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.10, released on 2023-11-17.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1527] - Added a password confirmation before changing a user’s local password in the profile information page\n\n [HRZ-1528] - Added the Secure flag to the PLAY_SESSION cookie to prevent sending the session information over non-HTTPS connections\n\n [HRZ-1555] - Enhanced parsing of Cron expressions\n\n [HRZ-1557] - Enhanced handling of the activationDate property\n\n 3. API modifications\n\n [HRZ-1527] - Resetting your own local password now requires the 'previousPassword' property\n\n 4. Bug Fixes\n\n [HRZ-1529] - Emails on the local identity principals endpoints are now correctly validated\n\n 5. Known Defects\n\n [HRZ-1649] - The horizon-upgrade tool does not look for the migration scripts in the right path. A workaround is available, see the referenced problem on the customer support platform.\n\n Horizon 2.4.11 release notes\n Horizon 2.4.9 release notes", + "summary": "Horizon 2.10.2 release notes Here are the release notes for EverTrust Horizon v2.10.2, released on 2026-06-25. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhance", + "content": "Horizon 2.10.2 release notes\n\n Here are the release notes for EverTrust Horizon v2.10.2, released on 2026-06-25.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n The certificate CSV export now includes the OS and Path from the discovery data\n\n 3. Bug Fixes\n\n Fixed an issue where certificates could not be enrolled or renewed with a Nexus CM PKI\n\n Fixed an issue where announcements were not displayed for users without permissions\n\n Fixed an issue where renewal requests could not be opened when they were created through the API without using the module property\n\n Fixed an issue where event analytics synchronization could fail\n\n Fixed a UI issue where the Extensions card overflowed horizontally when displaying long values in the Crypto Decoder\n\n Fixed a UI issue where action buttons were missing from the Search Certificates page\n\n Fixed a UI issue where the \"Key Usages\" card was missing from the certificate \"More Details\" page\n\n Fixed a UI issue where asynchronous notifications were not properly displayed on the Edit SCEP Profile page\n\n Fixed a UI issue where the status of a policy was not displayed on the DCV Lifecycle page\n\n Fixed a UI issue where the Netscaler category was not displayed in the side navigation\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Searching requests and certificates\n Horizon 2.10.1 release notes", "keywords": [ "horizon", "10", @@ -14022,331 +5044,15 @@ ] }, { - "page_id": "horizon:2.4:release-notes:2.4.11", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.11 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.11", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.11.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.11.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.11 release notes" - ], - "summary": "Horizon 2.4.11 release notes Here are the release notes for EverTrust Horizon v2.4.11, released on 2023-12-12. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer su", - "content": "Horizon 2.4.11 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.11, released on 2023-12-12.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1645] - Improved OpenShift/HAProxy support for client certification authentication\n\n Improved error handling when interfacing with slow PKIs.\n\n 3. API modifications\n\n [None]\n\n 4. Bug Fixes\n\n [HRZ-1649] - The horizon-upgrade tool searches the migration scripts in the right path again\n\n 5. Known Defects\n\n [None]\n\n Horizon 2.4.12 release notes\n Horizon 2.4.10 release notes", - "keywords": [ - "horizon", - "11", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.12", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.12 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.12", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.12.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.12.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.12 release notes" - ], - "summary": "Horizon 2.4.12 release notes Here are the release notes for EverTrust Horizon v2.4.12, released on 2023-12-15. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer su", - "content": "Horizon 2.4.12 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.12, released on 2023-12-15.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1679] - Third party trigger warnings now register as failure to enable manual retry\n\n 3. API modifications\n\n [None]\n\n 4. Bug Fixes\n\n [HRZ-1678] - Certificate renewal via scheduled tasks linked to multiple third parties now properly keep previous certificate third party information\n\n 5. Known Defects\n\n [None]\n\n Horizon 2.4.13 release notes\n Horizon 2.4.11 release notes", - "keywords": [ - "horizon", - "12", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.13", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.13 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.13", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.13.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.13.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.13 release notes" - ], - "summary": "Horizon 2.4.13 release notes Here are the release notes for EverTrust Horizon v2.4.13, released on 2023-12-21. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer su", - "content": "Horizon 2.4.13 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.13, released on 2023-12-21.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. API modifications\n\n [None]\n\n 4. Bug Fixes\n\n [HRZ-1692] - Fixed performance issues on SCEP and EST enrollments when a large number of requests were validated on a profile.\n\n 5. Known Defects\n\n [None]\n\n Horizon 2.4.14 release notes\n Horizon 2.4.12 release notes", - "keywords": [ - "horizon", - "13", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.14", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.14 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.14", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.14.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.14.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.14 release notes" - ], - "summary": "Horizon 2.4.14 release notes Here are the release notes for EverTrust Horizon v2.4.14, released on 2024-01-09. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer su", - "content": "Horizon 2.4.14 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.14, released on 2024-01-09.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. API modifications\n\n [None]\n\n 4. Bug Fixes\n\n [HRZ-1720] - Fix a bug causing certificate authentication to fail with HAProxy\n\n [HRZ-1722] - Fix a bug causing certificate authentication to fail with local identity provider disabled\n\n 5. Known Defects\n\n [None]\n\n Searching requests and certificates\n Horizon 2.4.13 release notes", - "keywords": [ - "horizon", - "14", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.2", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.2 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.2", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.2.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.2.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.2 release notes" - ], - "summary": "Horizon 2.4.2 release notes Here are the release notes for EverTrust Horizon v2.4.2, released on 2023-06-19. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer supp", - "content": "Horizon 2.4.2 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.2, released on 2023-06-19.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1313] - Add support for random UserID in docker containers for OpenShift compatibility\n\n 3. Bug Fixes\n\n [HRZ-1308] - Making the contact email editable on existing profiles to comply with 2.3.x behavior\n\n [HRZ-1304] - Automation policy compliance list now allow all when the list is empty\n\n [HRZ-1275] - Mandatory extension with computation rule is now allowed\n\n [HRZ-1307] - Special characters can now be used when creating an authorization\n\n [HRZ-1305] - Support ACME automation when ports are not defined in the ACME profile\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.4.3 release notes\n Horizon 2.4.1 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.3", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.3 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.3", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.3.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.3.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.3 release notes" - ], - "summary": "Horizon 2.4.3 release notes Here are the release notes for EverTrust Horizon v2.4.3, released on 2023-06-21. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer supp", - "content": "Horizon 2.4.3 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.3, released on 2023-06-21.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1315] - Upgrading PKI-Connector library to 2.0.5, adding compatibility with Entrust Certificate Services 2.9.0\n\n 3. Bug Fixes\n\n [None]\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.4.4 release notes\n Horizon 2.4.2 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.4", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.4 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.4", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.4.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.4.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.4 release notes" - ], - "summary": "Horizon 2.4.4 release notes Here are the release notes for EverTrust Horizon v2.4.4, released on 2023-06-22. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer supp", - "content": "Horizon 2.4.4 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.4, released on 2023-06-22.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1321] - Allowing OpenID identity provider to send scopes not present in the metadata supported scopes\n\n [HRZ-1319] - Do not fail OpenID authentication if UserInfo call fails\n\n [HRZ-1322] - Horizon will no longer start if Horizon schema version does not match product version\n\n 3. Bug Fixes\n\n [None]\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.4.5 release notes\n Horizon 2.4.3 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.5", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.5 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.5", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.5.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.5.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.5 release notes" - ], - "summary": "Horizon 2.4.5 release notes Here are the release notes for EverTrust Horizon v2.4.5, released on 2023-07-07. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer supp", - "content": "Horizon 2.4.5 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.5, released on 2023-07-07.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1288] - Add the support of all RFC specific characters in email addresses\n\n [HRZ-1255] - Improve the display of long requester and approver names in the request view\n\n 3. Bug Fixes\n\n [HRZ-1327] - Fixed a bug where a user with specific roles configuration could see unmanageable requests (permission flow was not impacted)\n\n [HRZ-1326] - Requester comment is now always displayed as expected\n\n [HRZ-1287] - Fixed a bug that listed members of a role as belonging to an other role in specific cases\n\n [HRZ-1267] - Fixed a bug where the request contact email was not editable as approver in recover requests\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.4.6 release notes\n Horizon 2.4.4 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.6", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.6 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.6", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.6.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.6.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.6 release notes" - ], - "summary": "Horizon 2.4.6 release notes Here are the release notes for EverTrust Horizon v2.4.6, released on 2023-08-23. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer supp", - "content": "Horizon 2.4.6 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.6, released on 2023-08-23.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1352] - Improved logging speed for discovery process events\n\n [HRZ-1390] - Added a dry run option in a submitted request\n\n [HRZ-1406] - Added JSON format for logging syslog events\n\n 3. Bug Fixes\n\n [HRZ-1385] - Fixed a bug where enroll and revocation requests with Digicert PKI connector failed when a custom data mapping was defined\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.4.7 release notes\n Horizon 2.4.5 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.7", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.7 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.7", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.7.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.7.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.7 release notes" - ], - "summary": "Horizon 2.4.7 release notes Here are the release notes for EverTrust Horizon v2.4.7, released on 2023-09-13. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer supp", - "content": "Horizon 2.4.7 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.7, released on 2023-09-13.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1450] - Contact email address can now be set in discovered certificates\n\n [HRZ-1432] - Improving validation error on EST Swap Certificate\n\n [HRZ-1443] - Adding the client source IP in the JSON logger\n\n 3. Bug Fixes\n\n [HRZ-1412] - Fixing a bug where a request could not be approved if the associated profile had a computation rule\n\n [HRZ-1413] - Fixing a bug when submitting a request with an invalid MsSid\n\n [HRZ-1429] - Fixing an incompatibility with Traefik 2.9.4 for certificate authentication\n\n [HRZ-1433] - Fixing a bug where a certificate was enrolled without metadata in EST challenge mode in specific cases\n\n [HRZ-1445] - Fixing a bug where an unexpected error appeared when trying to display a request when the same Holder ID was used within a discovered certificate\n\n [HRZ-1447] - Fixing a bug where an unexpected error appeared when enrolling on a profile where all authorized key types were selected\n\n 4. Known Defects\n\n [HRZ-1545] - Source IP can be incorrectly retrieved in the logs\n\n Horizon 2.4.8 release notes\n Horizon 2.4.6 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.8", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.8 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.8", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.8.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.8.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.8 release notes" - ], - "summary": "Horizon 2.4.8 release notes Here are the release notes for EverTrust Horizon v2.4.8, released on 2023-10-12. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer supp", - "content": "Horizon 2.4.8 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.8, released on 2023-10-12.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HRZ-1494] - Fixing a bug where a principal being part of multiple teams could not see its teams request in \"My requests\"\n\n [HRZ-1519] - Fixing a bug where dns names were forced to lowercase in ACME when the authorized shortname option was enabled\n\n 4. Known Defects\n\n [HRZ-1545] - Source IP can be incorrectly retrieved in the logs\n\n Horizon 2.4.9 release notes\n Horizon 2.4.7 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:release-notes:2.4.9", - "product": "horizon", - "kind": "product", - "source": "antora", - "version": "2.4", - "title": "Horizon 2.4.9 release notes", - "section": "release-notes", - "slug": "release-notes/2.4.9", - "url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.9.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/release-notes/2.4.9.html", - "breadcrumbs": [ - "Horizon", - "Release notes", - "Horizon 2.4.9 release notes" - ], - "summary": "Horizon 2.4.9 release notes Here are the release notes for EverTrust Horizon v2.4.9, released on 2023-11-07. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. horizon-upgrade tool no longer supp", - "content": "Horizon 2.4.9 release notes\n\n Here are the release notes for EverTrust Horizon v2.4.9, released on 2023-11-07.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n horizon-upgrade tool no longer supports mongo legacy shell. mongosh is now required.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HRZ-1547] - Third party data is now retrieved from previous in a manual renew\n\n 3. Bug Fixes\n\n [HRZ-1545] - Fixing a bug where source IP was incorrectly retrieved in the logs\n\n [HRZ-1548] - Fixing a bug where approve workflow was impossible if a non editable computation rule was set on the contact email field\n\n [HRZ-1520] - Fixing a bug where a principal with manage rights on identity provider could not access the configuration menu\n\n 4. Known Defects\n\n [None]\n\n Horizon 2.4.10 release notes\n Horizon 2.4.8 release notes", - "keywords": [ - "horizon", - "release", - "notes", - "release-notes", - "release-notes/2" - ] - }, - { - "page_id": "horizon:2.4:user-guide:est", + "page_id": "horizon:2.10:user-guide:est", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", + "version": "2.10", "title": "How to Request an EST challenge", "section": "user-guide", "slug": "user-guide/est", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/est.html", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/est.html", "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/est.html", "breadcrumbs": ["Horizon", "User guide", "Requesting an EST challenge"], "summary": "How to Request an EST challenge This section details how you can get an EST Challenge. 1. Log in to Horizon Registration Authority Interface 2. Access Request an EST Challenge from the drawer: Request an EST Challenge You must have the perm", @@ -14367,38 +5073,37 @@ ] }, { - "page_id": "horizon:2.4:user-guide:introduction", + "page_id": "horizon:2.10:user-guide:introduction", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", - "title": "Introduction", + "version": "2.10", + "title": "User guide", "section": "user-guide", "slug": "user-guide/introduction", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/introduction.html", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/introduction.html", "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/introduction.html", - "breadcrumbs": ["Horizon", "User guide", "Introduction"], - "summary": "Introduction Description Horizon is an EverTrust Certificate lifecycle management solution and is powered up by: Akka BouncyCastle MongoDB Kamon Play! Framework Scala NGINX Vue.js Quasar This document is specific to Horizon version 2.4 . Lo", - "content": "Introduction\n\n Description\n\n Horizon is an EverTrust Certificate lifecycle management solution and is powered up by:\n\n Akka\n\n BouncyCastle\n\n MongoDB\n\n Kamon\n\n Play! Framework\n\n Scala\n\n NGINX\n\n Vue.js\n\n Quasar\n\n This document is specific to Horizon version 2.4 .\n\n Logging\n Managing requests on the WebRA", + "breadcrumbs": ["Horizon", "User guide"], + "summary": "User guide Description The user guide describes how end-users should interact with Horizon. Prerequisites To use Horizon, you need the following prerequisites: an up and running Horizon instance , which you can access through your web brows", + "content": "User guide\n\n Description\n\n The user guide describes how end-users should interact with Horizon.\n\n Prerequisites\n\n To use Horizon, you need the following prerequisites:\n\n an up and running Horizon instance , which you can access through your web browser;\n\n a correctly configured platform ;\n\n Reset tenant administrator account\n Managing requests on the WebRA", "keywords": [ - "introduction", + "user", + "guide", "user-guide", "user-guide/introduction", - "horizon", - "user", - "guide" + "horizon" ] }, { - "page_id": "horizon:2.4:user-guide:manage_requests", + "page_id": "horizon:2.10:user-guide:manage_requests", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", + "version": "2.10", "title": "Operator", "section": "user-guide", "slug": "user-guide/manage_requests", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/manage_requests.html", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/manage_requests.html", "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/manage_requests.html", "breadcrumbs": ["Horizon", "User guide", "Managing requests (operator)"], "summary": "Operator An Operator is someone who owns the permission to approve or deny a request. Manage Request This section details how to manage a request (view, approve, deny). 1. Log in to Horizon Registration Authority Interface 2. Access Manages", @@ -14415,15 +5120,15 @@ ] }, { - "page_id": "horizon:2.4:user-guide:scep", + "page_id": "horizon:2.10:user-guide:scep", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", + "version": "2.10", "title": "How to Request a SCEP challenge", "section": "user-guide", "slug": "user-guide/scep", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/scep.html", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/scep.html", "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/scep.html", "breadcrumbs": ["Horizon", "User guide", "Requesting a SCEP challenge"], "summary": "How to Request a SCEP challenge This section details how you can get a SCEP Challenge. 1. Log in to Horizon Registration Authority Interface 2. Access Request a SCEP Challenge from the drawer: Request a SCEP Challenge You must have the perm", @@ -14443,15 +5148,15 @@ ] }, { - "page_id": "horizon:2.4:user-guide:search", + "page_id": "horizon:2.10:user-guide:search", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", + "version": "2.10", "title": "Searching requests and certificates", "section": "user-guide", "slug": "user-guide/search", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/search.html", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/search.html", "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/search.html", "breadcrumbs": [ "Horizon", @@ -14459,7 +5164,7 @@ "Searching requests and certificates" ], "summary": "Search Request Here is the section where you can search easily find all information regarding the request. How to do a simple request search 1. Log in to Horizon Registration Authority Interface 2. Access request search from the drawer: My ", - "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.4.14 release notes", + "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.10.2 release notes", "keywords": [ "searching", "requests", @@ -14473,15 +5178,52 @@ ] }, { - "page_id": "horizon:2.4:user-guide:webra:enroll", + "page_id": "horizon:2.10:user-guide:webra:duplicate", + "product": "horizon", + "kind": "product", + "source": "antora", + "version": "2.10", + "title": "How to request a certificate duplication", + "section": "user-guide", + "slug": "user-guide/webra/duplicate", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/duplicate.html", + "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/duplicate.html", + "breadcrumbs": [ + "Horizon", + "User guide", + "Managing requests on the WebRA", + "How to request a certificate duplication" + ], + "summary": "How to request a certificate duplication A Duplication is a simplification of the enroll process. When choosing the duplication on a certificate, a new certificate enrollment request is created with the information from the previous certifi", + "content": "How to request a certificate duplication\n\n A Duplication is a simplification of the enroll process. When choosing the duplication on a certificate, a new certificate enrollment request is created with the information from the previous certificate. Certificate data and metadata are still editable, as opposed to a renewal .\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request duplication from the drawer: My certificates or Search certificates\n\n 3. Click on request duplication button\n\n Profile tab\n\n 4. Fill in all the mandatory fields\n\n Key type * (string) :\n\nThe key type will be used for the private key generation\n\n In case of the definition of a password policy:\n\n Password * (string) :\n\nThe password will be used for the PKCS#12 encryption\n\n 5. Go to enroll (same as duplicate) and follow all the steps\n\n How to request a certificate update\n How to request a certificate renewal", + "keywords": [ + "how", + "to", + "request", + "certificate", + "duplication", + "user-guide", + "user-guide/webra/duplicate", + "horizon", + "user", + "guide", + "managing", + "requests", + "on", + "the", + "webra" + ] + }, + { + "page_id": "horizon:2.10:user-guide:webra:enroll", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", + "version": "2.10", "title": "How to enroll a certificate using the WebRA", "section": "user-guide", "slug": "user-guide/webra/enroll", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/webra/enroll.html", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/enroll.html", "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/enroll.html", "breadcrumbs": [ "Horizon", @@ -14510,69 +5252,57 @@ ] }, { - "page_id": "horizon:2.4:user-guide:webra:recover", + "page_id": "horizon:2.10:user-guide:webra:import", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", - "title": "How to request a certificate recovery", + "version": "2.10", + "title": "How to request a certificate import", "section": "user-guide", - "slug": "user-guide/webra/recover", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/webra/recover.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/recover.html", - "breadcrumbs": [ - "Horizon", - "User guide", - "Managing requests on the WebRA", - "How to request a certificate recovery" - ], - "summary": "How to request a certificate recovery 1. Log in to Horizon Registration Authority Interface 2. Access request recover from the drawer: My certificates or Search certificates 3. Click on request recover button Recover Options tab 4. Fill in ", - "content": "How to request a certificate recovery\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request recover from the drawer: My certificates or Search certificates\n\n 3. Click on request recover button\n\n Recover Options tab\n\n 4. Fill in the information you want to add.\n\n Contact_Email (string email format) :\n\nUsed if an email configuration is set. An email can be sent every time the request status change (see request lifecycle ).\n\n Recover comment (string input) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n Certificate tab\n\n 5. You can also check the certificate information\n\n Ownership tab\n\n 6. You can also check the certificate ownership information\n\n 7. Once you have checked and added the information you wanted you can request the recover by clicking on the recover button\n\n 8. You will be able to see and copy the password and download the certificate PKCS#12\n\n How to request a certificate renewal\n Requesting a SCEP challenge", + "slug": "user-guide/webra/import", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/import.html", + "breadcrumbs": ["Horizon", "How to request a certificate import"], + "summary": "How to request a certificate import A certificate import will save the associated certificate to the requested profile, with its private key if escrow is enabled. 1. Log in to Horizon Registration Authority Interface 2. Access request renew", + "content": "How to request a certificate import\n\n A certificate import will save the associated certificate to the requested profile, with its private key if escrow is enabled.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request renew from the drawer: My certificates or Search certificates\n\n 3. Click on request renew button\n\n Renew options tab\n\n 4. Fill in all the fields\n\n Key type * (string) :\n\n Enabled on centralized enrollment: The key type will be used for the private key generation.\n\n Password * (string) :\n\n Enabled on centralized enrollment with manual password policy: The password will be used for the PKCS#12 encryption.\n\n CSR * (string) :\n\n Enabled on decentralized enrollment: The CSR, defining the public key of the enrolled certificate.\n\n Comment (string) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n Certificate tab\n\n 5. You can also check the certificate information\n\n Ownership tab\n\n 6. You can also check the certificate ownership information\n\n 7. Renew. You will obtain a strictly identical certificate to the one used for renewal, except for the key.", "keywords": [ "how", "to", "request", "certificate", - "recovery", + "import", "user-guide", - "user-guide/webra/recover", - "horizon", - "user", - "guide", - "managing", - "requests", - "on", - "the", - "webra" + "user-guide/webra/import", + "horizon" ] }, { - "page_id": "horizon:2.4:user-guide:webra:reenroll", + "page_id": "horizon:2.10:user-guide:webra:recover", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", - "title": "How to request a certificate reenroll", + "version": "2.10", + "title": "How to request a certificate recovery", "section": "user-guide", - "slug": "user-guide/webra/reenroll", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/webra/reenroll.html", - "canonical_url": "https://docs.evertrust.fr/horizon/2.4/user-guide/webra/reenroll.html", + "slug": "user-guide/webra/recover", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/recover.html", + "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/recover.html", "breadcrumbs": [ "Horizon", "User guide", "Managing requests on the WebRA", - "How to request a certificate reenroll" + "How to request a certificate recovery" ], - "summary": "How to request a certificate reenroll A ReEnroll is a simplification of the enroll process. When choosing the reenroll on a certificate, a new certificate enrollment request is created with the information from the previous certificate. Cer", - "content": "How to request a certificate reenroll\n\n A ReEnroll is a simplification of the enroll process. When choosing the reenroll on a certificate, a new certificate enrollment request is created with the information from the previous certificate. Certificate data and metadata are still editable, as opposed to a renewal .\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request reenroll from the drawer: My certificates or Search certificates\n\n 3. Click on request reenroll button\n\n Profile tab\n\n 4. Fill in all the mandatory fields\n\n Key type * (string) :\n\nThe key type will be used for the private key generation\n\n In case of the definition of a password policy:\n\n Password * (string) :\n\nThe password will be used for the PKCS#12 encryption\n\n 5. Go to enroll (same as reenroll) and follow all the steps\n\n How to request a certificate update\n How to request a certificate renewal", + "summary": "How to request a certificate recovery 1. Log in to Horizon Registration Authority Interface 2. Access request recover from the drawer: My certificates or Search certificates 3. Click on request recover button Recover Options tab 4. Fill in ", + "content": "How to request a certificate recovery\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request recover from the drawer: My certificates or Search certificates\n\n 3. Click on request recover button\n\n Recover Options tab\n\n 4. Fill in the information you want to add.\n\n Contact_Email (string email format) :\n\nUsed if an email configuration is set. An email can be sent every time the request status change (see request lifecycle ).\n\n Recover comment (string input) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n Certificate tab\n\n 5. You can also check the certificate information\n\n Ownership tab\n\n 6. You can also check the certificate ownership information\n\n 7. Once you have checked and added the information you wanted you can request the recover by clicking on the recover button\n\n 8. You will be able to see and copy the password and download the certificate PKCS#12\n\n How to request a certificate renewal\n Requesting a SCEP challenge", "keywords": [ "how", "to", "request", "certificate", - "reenroll", + "recovery", "user-guide", - "user-guide/webra/reenroll", + "user-guide/webra/recover", "horizon", "user", "guide", @@ -14584,15 +5314,15 @@ ] }, { - "page_id": "horizon:2.4:user-guide:webra:renew", + "page_id": "horizon:2.10:user-guide:webra:renew", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", + "version": "2.10", "title": "How to request a certificate renewal", "section": "user-guide", "slug": "user-guide/webra/renew", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/webra/renew.html", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/renew.html", "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/renew.html", "breadcrumbs": [ "Horizon", @@ -14601,7 +5331,7 @@ "How to request a certificate renewal" ], "summary": "How to request a certificate renewal A certificate renewal will enroll a certificate strictly identical to the previous one. No edition of certificate data or metadata can take place. 1. Log in to Horizon Registration Authority Interface 2.", - "content": "How to request a certificate renewal\n\n A certificate renewal will enroll a certificate strictly identical to the previous one. No edition of certificate data or metadata can take place.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request renew from the drawer: My certificates or Search certificates\n\n 3. Click on request renew button\n\n Renew options tab\n\n 4. Fill in all the fields\n\n Key type * (string) :\n\n Enabled on centralized enrollment: The key type will be used for the private key generation.\n\n Password * (string) :\n\n Enabled on centralized enrollment with manual password policy: The password will be used for the PKCS#12 encryption.\n\n CSR * (string) :\n\n Enabled on decentralized enrollment: The CSR, defining the public key of the enrolled certificate.\n\n Comment (string) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n Certificate tab\n\n 5. You can also check the certificate information\n\n Ownership tab\n\n 6. You can also check the certificate ownership information\n\n 7. Renew. You will obtain a strictly identical certificate to the one used for renewal, except for the key.\n\n How to request a certificate reenroll\n How to request a certificate recovery", + "content": "How to request a certificate renewal\n\n A certificate renewal will enroll a certificate strictly identical to the previous one. No edition of certificate data or metadata can take place.\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request renew from the drawer: My certificates or Search certificates\n\n 3. Click on request renew button\n\n Renew options tab\n\n 4. Fill in all the fields\n\n Key type * (string) :\n\n Enabled on centralized enrollment: The key type will be used for the private key generation.\n\n Password * (string) :\n\n Enabled on centralized enrollment with manual password policy: The password will be used for the PKCS#12 encryption.\n\n CSR * (string) :\n\n Enabled on decentralized enrollment: The CSR, defining the public key of the enrolled certificate.\n\n Comment (string) :\n\nThis comment appears:\n\n to the approver when your request is in the pending status.\n\n in the certificate info after the enrollment.\n\n Certificate tab\n\n 5. You can also check the certificate information\n\n Ownership tab\n\n 6. You can also check the certificate ownership information\n\n 7. Renew. You will obtain a strictly identical certificate to the one used for renewal, except for the key.\n\n How to request a certificate duplication\n How to request a certificate recovery", "keywords": [ "how", "to", @@ -14621,15 +5351,15 @@ ] }, { - "page_id": "horizon:2.4:user-guide:webra:revoke", + "page_id": "horizon:2.10:user-guide:webra:revoke", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", + "version": "2.10", "title": "How to request a certificate revocation", "section": "user-guide", "slug": "user-guide/webra/revoke", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/webra/revoke.html", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/revoke.html", "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/revoke.html", "breadcrumbs": [ "Horizon", @@ -14658,15 +5388,15 @@ ] }, { - "page_id": "horizon:2.4:user-guide:webra:update", + "page_id": "horizon:2.10:user-guide:webra:update", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", + "version": "2.10", "title": "How to request a certificate update", "section": "user-guide", "slug": "user-guide/webra/update", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/webra/update.html", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/update.html", "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/update.html", "breadcrumbs": [ "Horizon", @@ -14675,7 +5405,7 @@ "How to request a certificate update" ], "summary": "How to request a certificate update 1. Log in to Horizon Registration Authority Interface 2. Access request update from the drawer: My certificates or Search certificates 3. Click on request update button Labels tab 4. You can update in the", - "content": "How to request a certificate update\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request update from the drawer: My certificates or Search certificates\n\n 3. Click on request update button\n\n Labels tab\n\n 4. You can update in the labels section the labels\n\n Label (string input) :\n\nEnter a correct label\n\n Ownership tab\n\n 5. You can update the ownership information\n\n Owner (string input) :\n\nDisplayed if an owner policy is set. The owner of the certificate can search it, and request other actions on it (such as revoke, recover, ..).\n\n Contact email address (string email format) :\n\nDisplayed if an email policy is set. An email can be sent each time the request status changes (see request lifecycle ). This will also set the contact email of the certificate.\n\n Team (string input) :\n\nDisplayed if a team policy is set. A team has the same rights as an owner on a certificate.\n\n 6. You can also check the details information\n\n Certificate tab\n\n 7. You can also check the certificate information\n\n 8. Once you have made changes you can request the update by clicking on the update button\n\n How to request a certificate revocation\n How to request a certificate reenroll", + "content": "How to request a certificate update\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request update from the drawer: My certificates or Search certificates\n\n 3. Click on request update button\n\n Labels tab\n\n 4. You can update in the labels section the labels\n\n Label (string input) :\n\nEnter a correct label\n\n Ownership tab\n\n 5. You can update the ownership information\n\n Owner (string input) :\n\nDisplayed if an owner policy is set. The owner of the certificate can search it, and request other actions on it (such as revoke, recover, ..).\n\n Contact email address (string email format) :\n\nDisplayed if an email policy is set. An email can be sent each time the request status changes (see request lifecycle ). This will also set the contact email of the certificate.\n\n Team (string input) :\n\nDisplayed if a team policy is set. A team has the same rights as an owner on a certificate.\n\n 6. You can also check the details information\n\n Certificate tab\n\n 7. You can also check the certificate information\n\n 8. Once you have made changes you can request the update by clicking on the update button\n\n How to request a certificate revocation\n How to request a certificate duplication", "keywords": [ "how", "to", @@ -14695,25 +5425,26 @@ ] }, { - "page_id": "horizon:2.4:user-guide:webra:workflow", + "page_id": "horizon:2.10:user-guide:webra:workflow", "product": "horizon", "kind": "product", "source": "antora", - "version": "2.4", - "title": "Requester", + "version": "2.10", + "title": "Request workflow", "section": "user-guide", "slug": "user-guide/webra/workflow", - "url": "https://docs.evertrust.fr/horizon/2.4/user-guide/webra/workflow.html", + "url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/workflow.html", "canonical_url": "https://docs.evertrust.fr/horizon/2.10/user-guide/webra/workflow.html", "breadcrumbs": [ "Horizon", "User guide", "Managing requests on the WebRA" ], - "summary": "Requester By definition, a requester is someone who is granted the permission to request a certificate (enroll, renew, revoke, update, recover). Each Request has the same lifecycle described by the following figure. Figure 1. Request Workfl", - "content": "Requester\n\n By definition, a requester is someone who is granted the permission to request a certificate (enroll, renew, revoke, update, recover).\n\n Each Request has the same lifecycle described by the following figure.\n\n Figure 1. Request Workflow\n\n Introduction\n How to enroll a certificate using the WebRA", + "summary": "Request workflow Each Request has the same lifecycle described by the following figure. Figure 1. Request Workflow Requester A requester is someone who is granted the permission to request a certificate (enroll, renew, revoke, update, recov", + "content": "Request workflow\n\n Each Request has the same lifecycle described by the following figure.\n\n Figure 1. Request Workflow\n\n Requester\n\n A requester is someone who is granted the permission to request a certificate (enroll, renew, revoke, update, recover).\n\n Approver\n\n An approver is someone who is granted the permission to approve a request (enroll, renew, revoke, update, recover). An approver cannot approve its own request.\n\n Owner\n\n A request owner is someone who is designated as the benefactor for the request. It can view the request like the requester (in the My requests drawer), but unlike the requester, they can also access the certificate information (PKCS#12, challenge password).\n\n The owner is computed according to the following rules:\n\n enroll, update, migrate : the owner is the one defined in the request template (ownership tab)\n\n renew : the owner of the request is the owner of the renewed certificate\n\n recover : the owner is the requester of the recover request\n\n revoke : no owner is associated with the request\n\n Table 1. Owner vs Requester\n\n User type\n Can view the request\n Can view the PKCS#12\n Can view the challenge password\n\n Requester\n\n Yes\n\n No\n\n No\n\n Owner\n\n Yes\n\n Yes\n\n Yes\n\nAny user with the Enroll API/ Renew API permission can access the PKCS#12 or the challenge password for the workflow regardless of ownership status\n\n User guide\n How to enroll a certificate using the WebRA", "keywords": [ - "requester", + "request", + "workflow", "user-guide", "user-guide/webra/workflow", "horizon", @@ -33500,7 +24231,7 @@ "Horizon 2.8.0 release notes" ], "summary": "Horizon 2.8.0 release notes Here are the release notes for EverTrust Horizon v2.8.0, released on 2025-12-01. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. RPM deployments enforced constraint", - "content": "Horizon 2.8.0 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.0, released on 2025-12-01.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n RPM deployments enforced constraints on all DNS values. This default constraint has been removed for compatibility reasons.\nTo enable it again, the following configuration must be added :\n\n horizon.default.constraints.allowed.domains = \"^[a-zA-Z0-9\\\\.\\\\-\\\\*]*$\"\n\n In the Teams configuration, the manager email field has been removed and replaced with a list of managers who can manage team members.\nThe previous manager email is not carried over into this new value.\nAny notifications that referenced the team manager may need to be reconfigured to use the team’s contact email instead.\n\nInstance upgrade workflow has been altered, please refer to the relevant documentation\n\n When upgrading from a version prior to 2.8.0, a new keyset must be created using Tinkey before running the migration.\nThe migration tool will fail if the keyset is not generated.\n\n Please refer to the specific upgrade instructions section in the upgrade guide for detailed instructions on how to create a keyset using PlainText, PKCS#11, AWS KMS, or GCP KMS.\n\n 1. New Features\n\n [HRZ-3120] - Product update: Horizon now supports upgrading without downing all nodes (upgraded nodes will enter maintenance mode until the database schema is updated). Learn more…​\n\n [HRZ-3199] - Requests: PKCS#12 availability time is now configurable in profile configuration\n\n [HRZ-2961] - Teams: Added team managers who can add and remove team members\n\n [HRZ-2776] - Configuration: Added support for exporting and importing configuration from one instance to another\n\n [HRZ-2746] - Added monitored certificates to enable notification capabilities on non-manageable certificates\n\n [HRZ-2737] - Switched to industry standard Tink for encryption management\n\n [HRZ-2755] - Certificates and events can now be archived to Parquet files for cold storage\n\n [HRZ-2767] - Reports: Emails can now contain a link to download the CSV instead of an attachment\n\n 2. Enhancements\n\n [HRZ-3022] - Product update: Improved migration tool to allow for pre-migration checks\n\n [HRZ-2066] - Third parties: Added the capability to retry all failed triggers on a connector\n\n [HRZ-2957] - RA: Login popup now automatically redirects to the OIDC provider if only one OIDC provider is available\n\n [HRZ-2270] - Email notification: Added test capability on the UI\n\n [HRZ-2958] - RA: Identity provider can now be automatically selected using the selectedProviderName URL parameter on the /ui#/ra route\n\n [HRZ-3021] - Bootstrap: Default Local Identity provider now enforces a secure password policy\n\n [HRZ-3136] - Scheduled tasks: Added name field\n\n [HRZ-3164] - OIDC: Added PKCE support\n\n [HRZ-3219] - Template Strings: Added JSONArray helper function\n\n [HRZ-3305] - F5 AS3: Added an option to not add the chain on a certificate renewal\n\n [HRZ-3306] - F5 AS3: Certificate private keys will now keep the same encryption level on renewal\n\n 3. Bug Fixes\n\n [HRZ-2255] - Fixed a bug where requests submitted on profiles without a contactEmailPolicy could not be approved\n\n [HRZ-3193] - Fixed a bug where CRL database sync would take place every 15 minutes instead of the configured time in the CA configuration\n\n 4. Known Defects\n\n None\n\n 5. API modifications\n\n [HRZ-3136] - Scheduled task manipulation is now done using the name field instead of the _id field. The name field is now mandatory\n\n Horizon 2.8.1 release notes\n Configure tunnels", + "content": "Horizon 2.8.0 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.0, released on 2025-12-01.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n RPM deployments enforced constraints on all DNS values. This default constraint has been removed for compatibility reasons.\nTo enable it again, the following configuration must be added :\n\n horizon.default.constraints.allowed.domains = \"^[a-zA-Z0-9\\\\.\\\\-\\\\*]*$\"\n\n In the Teams configuration, the manager email field has been removed and replaced with a list of managers who can manage team members.\nThe previous manager email is not carried over into this new value.\nAny notifications that referenced the team manager may need to be reconfigured to use the team’s contact email instead.\n\nInstance upgrade workflow has been altered, please refer to the relevant documentation\n\n When upgrading from a version prior to 2.8.0, a new keyset must be created using Tinkey before running the migration.\nThe migration tool will fail if the keyset is not generated.\n\n Please refer to the specific upgrade instructions section in the upgrade guide for detailed instructions on how to create a keyset using PlainText, PKCS#11, AWS KMS, or GCP KMS.\n\n 1. New Features\n\n [HRZ-3120] - Product update: Horizon now supports upgrading without downing all nodes (upgraded nodes will enter maintenance mode until the database schema is updated). Learn more…​\n\n [HRZ-3199] - Requests: PKCS#12 availability time is now configurable in profile configuration\n\n [HRZ-2961] - Teams: Added team managers who can add and remove team members\n\n [HRZ-2776] - Configuration: Added support for exporting and importing configuration from one instance to another\n\n [HRZ-2746] - Added monitored certificates to enable notification capabilities on non-manageable certificates\n\n [HRZ-2737] - Switched to industry standard Tink for encryption management\n\n [HRZ-2755] - Certificates and events can now be archived to Parquet files for cold storage\n\n [HRZ-2767] - Reports: Emails can now contain a link to download the CSV instead of an attachment\n\n 2. Enhancements\n\n [HRZ-3022] - Product update: Improved migration tool to allow for pre-migration checks\n\n [HRZ-2066] - Third parties: Added the capability to retry all failed triggers on a connector\n\n [HRZ-2957] - RA: Login popup now automatically redirects to the OIDC provider if only one OIDC provider is available\n\n [HRZ-2270] - Email notification: Added test capability on the UI\n\n [HRZ-2958] - RA: Identity provider can now be automatically selected using the selectedProviderName URL parameter on the /ui#/ra route\n\n [HRZ-3021] - Bootstrap: Default Local Identity provider now enforces a secure password policy\n\n [HRZ-3136] - Scheduled tasks: Added name field\n\n [HRZ-3164] - OIDC: Added PKCE support\n\n [HRZ-3219] - Template Strings: Added JSONArray helper function\n\n [HRZ-3305] - F5 AS3: Added an option to not add the chain on a certificate renewal\n\n [HRZ-3306] - F5 AS3: Certificate private keys will now keep the same encryption level on renewal\n\n 3. Bug Fixes\n\n [HRZ-2255] - Fixed a bug where requests submitted on profiles without a contactEmailPolicy could not be approved\n\n [HRZ-3193] - Fixed a bug where CRL database sync would take place every 15 minutes instead of the configured time in the CA configuration\n\n 4. Known Defects\n\n Due to a misconfiguration, CRL synchronization could stop updating and remain out of date. To fix this, add the following line to the added in the extra configuration : crl-task-dispatcher.thread-pool-executor.fixed-pool-size = 7 . This issue has been resolved in 2.8.7\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.8.9\n\n 5. API modifications\n\n [HRZ-3136] - Scheduled task manipulation is now done using the name field instead of the _id field. The name field is now mandatory\n\n Horizon 2.8.1 release notes\n Configure tunnels", "keywords": [ "horizon", "release", @@ -33526,7 +24257,7 @@ "Horizon 2.8.1 release notes" ], "summary": "Horizon 2.8.1 release notes Here are the release notes for EverTrust Horizon v2.8.1, released on 2026-01-09. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", - "content": "Horizon 2.8.1 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.1, released on 2026-01-09.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-108] - Microsoft template v2 extensions are now supported when using the WCCE protocol (PKI support may vary)\n\n [HOR-207] - Enables WebRA profiles for automation policies\n\n [HOR-239] - ACME Connector: HMAC algorithm can now be specified manually when necessary\n\n [HOR-235] - Nameshield Connector: Added custom data mapping\n\n [HOR-129] - Dashboards can now be exported as PNG files from the dashboard page\n\n 3. Bug Fixes\n\n [HOR-188] - Fixed an issue where notifications would not retry automatically and could not be retried manually\n\n [HOR-160] - Fixed an issue where SANs deleted at the validation step would still be included in the final request\n\n [HOR-230] - Fixed an issue where the Mongo lease would not function correctly when using TLS authentication to the Mongo database\n\n [HOR-222] - Fixed an issue where long literals in HQL queries were not correctly handled\n\n [HOR-589] - Fixed an issue where pagination was not displayed on the Monitored profiles page\n\n [HOR-354] - Fixed an issue where certificate attachments could not be added to certificate import notifications\n\n [HOR-220] - Fixed an issue where OIDC connectors would not use Horizon’s trusted CAs\n\n [HOR-156] - Fixed an issue where long requests would not be entirely visible in report configuration\n\n [HOR-473] - Fixed an issue where CSRs with non-RFC-compliant extensions were rejected\n\n [HOR-124] - Fixed an issue where the renew_api permission would not allow searching for certificates to renew\n\n [HOR-123] - Fixed an issue where the crlLifetime parameter was not saved in the Integrated connector\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.2 release notes\n Horizon 2.8.0 release notes", + "content": "Horizon 2.8.1 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.1, released on 2026-01-09.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-108] - Microsoft template v2 extensions are now supported when using the WCCE protocol (PKI support may vary)\n\n [HOR-207] - Enables WebRA profiles for automation policies\n\n [HOR-239] - ACME Connector: HMAC algorithm can now be specified manually when necessary\n\n [HOR-235] - Nameshield Connector: Added custom data mapping\n\n [HOR-129] - Dashboards can now be exported as PNG files from the dashboard page\n\n 3. Bug Fixes\n\n [HOR-188] - Fixed an issue where notifications would not retry automatically and could not be retried manually\n\n [HOR-160] - Fixed an issue where SANs deleted at the validation step would still be included in the final request\n\n [HOR-230] - Fixed an issue where the Mongo lease would not function correctly when using TLS authentication to the Mongo database\n\n [HOR-222] - Fixed an issue where long literals in HQL queries were not correctly handled\n\n [HOR-589] - Fixed an issue where pagination was not displayed on the Monitored profiles page\n\n [HOR-354] - Fixed an issue where certificate attachments could not be added to certificate import notifications\n\n [HOR-220] - Fixed an issue where OIDC connectors would not use Horizon’s trusted CAs\n\n [HOR-156] - Fixed an issue where long requests would not be entirely visible in report configuration\n\n [HOR-473] - Fixed an issue where CSRs with non-RFC-compliant extensions were rejected\n\n [HOR-124] - Fixed an issue where the renew_api permission would not allow searching for certificates to renew\n\n [HOR-123] - Fixed an issue where the crlLifetime parameter was not saved in the Integrated connector\n\n 4. Known Defects\n\n Due to a misconfiguration, CRL synchronization could stop updating and remain out of date. To fix this, add the following line to the added in the extra configuration : crl-task-dispatcher.thread-pool-executor.fixed-pool-size = 7 . This issue has been resolved in 2.8.7\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.8.9\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.2 release notes\n Horizon 2.8.0 release notes", "keywords": [ "horizon", "release", @@ -33552,7 +24283,7 @@ "Horizon 2.8.2 release notes" ], "summary": "Horizon 2.8.2 release notes Here are the release notes for EverTrust Horizon v2.8.2, released on 2026-02-03. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", - "content": "Horizon 2.8.2 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.2, released on 2026-02-03.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-357] - Third party data updates from discovery on managed certificates can now be enabled in profile configuration. Learn more…​\n\n [HOR-604] - REST Notifications: REST requests can now be chained to allow complex request scenarios\n\n [HOR-544] - Stream connector: Now supports Microsoft Template V2 extension\n\n [HOR-644] - Modal windows no longer close when clicking outside\n\n [HOR-525] - Magic link reports can now be stored on S3 Buckets using advanced configuration. Learn more…​\n\n 3. Bug Fixes\n\n [HOR-635] - AWS Connector: certificate chain is now pushed in leaf to root order\n\n [HOR-701] - Nexus connector: Fixed an issue where multi valued DN elements and IP SANs were not transmitted\n\n [HOR-591] - Requests: Fixed a UI issue where teams could not be changed when using bulk validation\n\n [HOR-518] - Requests: Fixed a UI issue where teams could not be searched using their display name when approving a request\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [HOR-604] - REST notifications now require a sequence parameter containing the REST parameters for each request\n\n Horizon 2.8.3 release notes\n Horizon 2.8.1 release notes", + "content": "Horizon 2.8.2 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.2, released on 2026-02-03.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-357] - Third party data updates from discovery on managed certificates can now be enabled in profile configuration. Learn more…​\n\n [HOR-604] - REST Notifications: REST requests can now be chained to allow complex request scenarios\n\n [HOR-544] - Stream connector: Now supports Microsoft Template V2 extension\n\n [HOR-644] - Modal windows no longer close when clicking outside\n\n [HOR-525] - Magic link reports can now be stored on S3 Buckets using advanced configuration. Learn more…​\n\n 3. Bug Fixes\n\n [HOR-635] - AWS Connector: certificate chain is now pushed in leaf to root order\n\n [HOR-701] - Nexus connector: Fixed an issue where multi valued DN elements and IP SANs were not transmitted\n\n [HOR-591] - Requests: Fixed a UI issue where teams could not be changed when using bulk validation\n\n [HOR-518] - Requests: Fixed a UI issue where teams could not be searched using their display name when approving a request\n\n 4. Known Defects\n\n Due to a misconfiguration, CRL synchronization could stop updating and remain out of date. To fix this, add the following line to the added in the extra configuration : crl-task-dispatcher.thread-pool-executor.fixed-pool-size = 7 . This issue has been resolved in 2.8.7\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.8.9\n\n 5. API modifications\n\n [HOR-604] - REST notifications now require a sequence parameter containing the REST parameters for each request\n\n Horizon 2.8.3 release notes\n Horizon 2.8.1 release notes", "keywords": [ "horizon", "release", @@ -33578,7 +24309,7 @@ "Horizon 2.8.3 release notes" ], "summary": "Horizon 2.8.3 release notes Here are the release notes for EverTrust Horizon v2.8.3, released on 2026-02-23. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", - "content": "Horizon 2.8.3 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.3, released on 2026-02-23.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-157] - The certificate SANs are now displayed on revocation requests\n\n 3. Bug Fixes\n\n [HOR-820] - Fixed an issue where LDAP sockets created by the LDAP datasource were not properly closed\n\n [HOR-736] - Fixed an issue where anonymous requests could not be approved\n\n [HOR-764] - Fixed an issue where request approvals were blocked on enroll requests for users with label permissions\n\n [HOR-791] - Fixed an issue where proxy was not used for certain calls in the OIDC authentication flow\n\n [HOR-755] - Fixed an issue where 0-length password policies could be saved\n\n [HOR-852] - Fixed a UI issue where reports containing an empty body could not be edited\n\n [HOR-817] - Fixed a UI issue where discovery permissions could not be saved\n\n [HOR-814] - Fixed a UI issue where data sources were not available in the computation rule helper on certificate profiles in certain conditions\n\n [HOR-802] - Fixed a UI issue where a certificate could not be accessed using its ID\n\n [HOR-722] - Fixed a UI issue where a request could not be accessed using its ID\n\n [HOR-800] - Fixed a UI issue where Enrollment Agent Credentials edits were not saved on the ADCS connector\n\n [HOR-789] - Fixed inconsistent display of discovery panel in the More details certificate page\n\n [HOR-784] - Fixed a UI issue where selection bugs occurred on the export workflow\n\n [HOR-780] - Fixed a UI issue where filters could not be updated on the roles page\n\n [HOR-766] - Fixed a UI issue where SCEP authorized challenge could not be generated in SCEP profiles\n\n [HOR-742] - Fixed a UI issue where multi requests REST notifications behaved improperly when deleting a request\n\n [HOR-728] - Fixed a UI issue where a role could not be created using the Administrator template\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.4 release notes\n Horizon 2.8.2 release notes", + "content": "Horizon 2.8.3 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.3, released on 2026-02-23.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-157] - The certificate SANs are now displayed on revocation requests\n\n 3. Bug Fixes\n\n [HOR-820] - Fixed an issue where LDAP sockets created by the LDAP datasource were not properly closed\n\n [HOR-736] - Fixed an issue where anonymous requests could not be approved\n\n [HOR-764] - Fixed an issue where request approvals were blocked on enroll requests for users with label permissions\n\n [HOR-791] - Fixed an issue where proxy was not used for certain calls in the OIDC authentication flow\n\n [HOR-755] - Fixed an issue where 0-length password policies could be saved\n\n [HOR-852] - Fixed a UI issue where reports containing an empty body could not be edited\n\n [HOR-817] - Fixed a UI issue where discovery permissions could not be saved\n\n [HOR-814] - Fixed a UI issue where data sources were not available in the computation rule helper on certificate profiles in certain conditions\n\n [HOR-802] - Fixed a UI issue where a certificate could not be accessed using its ID\n\n [HOR-722] - Fixed a UI issue where a request could not be accessed using its ID\n\n [HOR-800] - Fixed a UI issue where Enrollment Agent Credentials edits were not saved on the ADCS connector\n\n [HOR-789] - Fixed inconsistent display of discovery panel in the More details certificate page\n\n [HOR-784] - Fixed a UI issue where selection bugs occurred on the export workflow\n\n [HOR-780] - Fixed a UI issue where filters could not be updated on the roles page\n\n [HOR-766] - Fixed a UI issue where SCEP authorized challenge could not be generated in SCEP profiles\n\n [HOR-742] - Fixed a UI issue where multi requests REST notifications behaved improperly when deleting a request\n\n [HOR-728] - Fixed a UI issue where a role could not be created using the Administrator template\n\n 4. Known Defects\n\n Due to a misconfiguration, CRL synchronization could stop updating and remain out of date. To fix this, add the following line to the added in the extra configuration : crl-task-dispatcher.thread-pool-executor.fixed-pool-size = 7 . This issue has been resolved in 2.8.7\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.8.9\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.4 release notes\n Horizon 2.8.2 release notes", "keywords": [ "horizon", "release", @@ -33604,7 +24335,7 @@ "Horizon 2.8.4 release notes" ], "summary": "Horizon 2.8.4 release notes Here are the release notes for EverTrust Horizon v2.8.4, released on 2026-03-12. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", - "content": "Horizon 2.8.4 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.4, released on 2026-03-12.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-776] - Add support for Netscaler Third Party Connector\n\n 3. Bug Fixes\n\n [HOR-932] - Fixed a UI issue when displaying team members without the Authorization permissions\n\n [HOR-929] - Fixed a UI issue when displaying role members without the Authorization permissions\n\n [HOR-925] - Fixed a UI issue where grade was not visible when hovering on it\n\n [HOR-905] - Fixed a UI issue where regex test field would not work properly\n\n [HOR-903] - Fixed an issue where setting a password policy without minimum character could sometimes result in password generation failures\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.5 release notes\n Horizon 2.8.3 release notes", + "content": "Horizon 2.8.4 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.4, released on 2026-03-12.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-776] - Add support for Netscaler Third Party Connector\n\n 3. Bug Fixes\n\n [HOR-932] - Fixed a UI issue when displaying team members without the Authorization permissions\n\n [HOR-929] - Fixed a UI issue when displaying role members without the Authorization permissions\n\n [HOR-925] - Fixed a UI issue where grade was not visible when hovering on it\n\n [HOR-905] - Fixed a UI issue where regex test field would not work properly\n\n [HOR-903] - Fixed an issue where setting a password policy without minimum character could sometimes result in password generation failures\n\n 4. Known Defects\n\n Due to a misconfiguration, CRL synchronization could stop updating and remain out of date. To fix this, add the following line to the added in the extra configuration : crl-task-dispatcher.thread-pool-executor.fixed-pool-size = 7 . This issue has been resolved in 2.8.7\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.8.9\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.5 release notes\n Horizon 2.8.3 release notes", "keywords": [ "horizon", "release", @@ -33630,7 +24361,7 @@ "Horizon 2.8.5 release notes" ], "summary": "Horizon 2.8.5 release notes Here are the release notes for EverTrust Horizon v2.8.5, released on 2026-03-31. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", - "content": "Horizon 2.8.5 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.5, released on 2026-03-31.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-1092] - Added Base64 and Raw functions to computation rules\n\n 3. Bug Fixes\n\n [HOR-1092] - Fixed a display issue when configuring SCIM protocol permissions\n\n [HOR-1041] - HCQL: fixed suggestions on the valid.until keyword\n\n [HOR-1004] - Fixed an issue where migration on profiles of the same module was not possible, as well as rare occurrences where the migrate button would not appear where it should\n\n [HOR-974] - Fixed an issue where Netscaler store path was not marked as mandatory on the UI\n\n [HOR-954] - Fixed an issue where SCIM profile configuration could not be saved after update\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.6 release notes\n Horizon 2.8.4 release notes", + "content": "Horizon 2.8.5 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.5, released on 2026-03-31.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-1092] - Added Base64 and Raw functions to computation rules\n\n 3. Bug Fixes\n\n [HOR-1092] - Fixed a display issue when configuring SCIM protocol permissions\n\n [HOR-1041] - HCQL: fixed suggestions on the valid.until keyword\n\n [HOR-1004] - Fixed an issue where migration on profiles of the same module was not possible, as well as rare occurrences where the migrate button would not appear where it should\n\n [HOR-974] - Fixed an issue where Netscaler store path was not marked as mandatory on the UI\n\n [HOR-954] - Fixed an issue where SCIM profile configuration could not be saved after update\n\n 4. Known Defects\n\n Due to a misconfiguration, CRL synchronization could stop updating and remain out of date. To fix this, add the following line to the added in the extra configuration : crl-task-dispatcher.thread-pool-executor.fixed-pool-size = 7 . This issue has been resolved in 2.8.7\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.8.9\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.6 release notes\n Horizon 2.8.4 release notes", "keywords": [ "horizon", "release", @@ -33656,7 +24387,7 @@ "Horizon 2.8.6 release notes" ], "summary": "Horizon 2.8.6 release notes Here are the release notes for EverTrust Horizon v2.8.6, released on 2026-04-24. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-639] - Brainpo", - "content": "Horizon 2.8.6 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.6, released on 2026-04-24.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-639] - Brainpool ECDSA elliptic curves (brainpoolp256r1, brainpoolp384r1, brainpoolp512r1) are now supported for certificate decoding, discovery, and enrollment options\n\n [HOR-1152] - A new Prometheus metric evertrust_horizon_maintenance_status is now exposed, indicating whether the instance is under maintenance\n\n 2. Enhancements\n\n [HOR-1130] - SCEP MDM profiles for Intune now support POST as GET operations\n\n 3. Bug Fixes\n\n [HOR-1147] - Fixed a UI issue where clicking the update action from the certificate detail page opened an update form in a modal instead of displaying a validation message\n\n [HOR-1176] - Fixed a UI issue where the discovery tab had a broken layout for certificates discovered by at least two campaigns\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.7 release notes\n Horizon 2.8.5 release notes", + "content": "Horizon 2.8.6 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.6, released on 2026-04-24.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-639] - Brainpool ECDSA elliptic curves (brainpoolp256r1, brainpoolp384r1, brainpoolp512r1) are now supported for certificate decoding, discovery, and enrollment options\n\n [HOR-1152] - A new Prometheus metric evertrust_horizon_maintenance_status is now exposed, indicating whether the instance is under maintenance\n\n 2. Enhancements\n\n [HOR-1130] - SCEP MDM profiles for Intune now support POST as GET operations\n\n 3. Bug Fixes\n\n [HOR-1147] - Fixed a UI issue where clicking the update action from the certificate detail page opened an update form in a modal instead of displaying a validation message\n\n [HOR-1176] - Fixed a UI issue where the discovery tab had a broken layout for certificates discovered by at least two campaigns\n\n 4. Known Defects\n\n Due to a misconfiguration, CRL synchronization could stop updating and remain out of date. To fix this, add the following line to the added in the extra configuration : crl-task-dispatcher.thread-pool-executor.fixed-pool-size = 7 . This issue has been resolved in 2.8.7\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.8.9\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.7 release notes\n Horizon 2.8.5 release notes", "keywords": [ "horizon", "release", @@ -33682,7 +24413,7 @@ "Horizon 2.8.7 release notes" ], "summary": "Horizon 2.8.7 release notes Here are the release notes for EverTrust Horizon v2.8.7, released on 2026-05-12. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", - "content": "Horizon 2.8.7 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.7, released on 2026-05-12.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HOR-1291] - Fixed a UI issue where default emails configured in ACME profiles were not persisted\n\n [HOR-1289] - Globalsign Atlas connector: fixed an issue where pending requests were considered as failed\n\n [HOR-1268] - Fixed an issue where horizon-config could not be run on Ubuntu\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.8 release notes\n Horizon 2.8.6 release notes", + "content": "Horizon 2.8.7 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.7, released on 2026-05-12.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HOR-1291] - Fixed a UI issue where default emails configured in ACME profiles were not persisted\n\n [HOR-1289] - Globalsign Atlas connector: fixed an issue where pending requests were considered as failed\n\n [HOR-1268] - Fixed an issue where horizon-config could not be run on Ubuntu\n\n [HOR-1147] - Fixed a configuration issue that could cause CRL synchronization to stop running\n\n 4. Known Defects\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.8.9\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.8 release notes\n Horizon 2.8.6 release notes", "keywords": [ "horizon", "release", @@ -33708,7 +24439,33 @@ "Horizon 2.8.8 release notes" ], "summary": "Horizon 2.8.8 release notes Here are the release notes for EverTrust Horizon v2.8.8, released on 2026-06-05. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", - "content": "Horizon 2.8.8 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.8, released on 2026-06-05.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-1524] - Improved compatibility for WCCE enrollment with fullResponse support.\n\n 3. Bug Fixes\n\n [HOR-1518] - Fixed an issue where OCSP requests could fail on OCSP responders that did not accept the Nonce extension as critical\n\n [HOR-1418] - Fixed a UI issue where a wrong HCQL suggestion for keyCategory was available\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Searching requests and certificates\n Horizon 2.8.7 release notes", + "content": "Horizon 2.8.8 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.8, released on 2026-06-05.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-1524] - Improved compatibility for WCCE enrollment with fullResponse support.\n\n 3. Bug Fixes\n\n [HOR-1518] - Fixed an issue where OCSP requests could fail on OCSP responders that did not accept the Nonce extension as critical\n\n [HOR-1418] - Fixed a UI issue where a wrong HCQL suggestion for keyCategory was available\n\n 4. Known Defects\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.8.9\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.9 release notes\n Horizon 2.8.7 release notes", + "keywords": [ + "horizon", + "release", + "notes", + "release-notes", + "release-notes/2" + ] + }, + { + "page_id": "horizon:2.8:release-notes:2.8.9", + "product": "horizon", + "kind": "product", + "source": "antora", + "version": "2.8", + "title": "Horizon 2.8.9 release notes", + "section": "release-notes", + "slug": "release-notes/2.8.9", + "url": "https://docs.evertrust.fr/horizon/2.8/release-notes/2.8.9.html", + "canonical_url": "https://docs.evertrust.fr/horizon/2.8/release-notes/2.8.9.html", + "breadcrumbs": [ + "Horizon", + "Release notes", + "Horizon 2.8.9 release notes" + ], + "summary": "Horizon 2.8.9 release notes Here are the release notes for EverTrust Horizon v2.8.9, released on 2026-06-25. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", + "content": "Horizon 2.8.9 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.9, released on 2026-06-25.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n The certificate CSV export now includes the OS and Path from the discovery data\n\n 3. Bug Fixes\n\n Fixed an issue where renewal requests could not be opened when they were created through the API without using the module property\n\n Fixed an issue where the AKV renewal scheduled task filtered certificates by connector prefix, resulting in no renewal for these certificates\n\n Fixed an issue where event analytics synchronization could fail\n\n Fixed a UI issue where the Extensions card overflowed horizontally when displaying long values in the Crypto Decoder\n\n Fixed a UI issue where the \"Key Usages\" card was missing from the certificate \"More Details\" page\n\n Fixed a UI issue where asynchronous notifications were not properly displayed on the Edit SCEP Profile page\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Searching requests and certificates\n Horizon 2.8.8 release notes", "keywords": [ "horizon", "release", @@ -33838,7 +24595,7 @@ "Searching requests and certificates" ], "summary": "Search Request Here is the section where you can search easily find all information regarding the request. How to do a simple request search 1. Log in to Horizon Registration Authority Interface 2. Access request search from the drawer: My ", - "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.8.8 release notes", + "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.8.9 release notes", "keywords": [ "searching", "requests", @@ -38574,7 +29331,7 @@ "canonical_url": "https://docs.evertrust.fr/horizon/2.10/install-guide/tenancy.html", "breadcrumbs": ["Horizon", "Installation", "Multi-Tenancy"], "summary": "Multi-Tenancy Activation In order to activate multi-tenancy on an instance, a specific license must be used. Contact the Evertrust team for access. Multi-tenancy must be enabled when provisioning a new instance, and cannot be disabled after", - "content": "Multi-Tenancy\n\n Activation\n\n In order to activate multi-tenancy on an instance, a specific license must be used.\nContact the Evertrust team for access.\n\nMulti-tenancy must be enabled when provisioning a new instance, and cannot be disabled afterwards.\nThis means that switching an instance between multi-tenancy modes is not possible.\n\n Tenant isolation\n\n Horizon uses logical isolation, meaning that a single database is used for all tenants of an instance.\n\n To discriminate between tenants, Horizon uses the x-tenant header.\nUsing a header allows for a highly customizable tenant access model.\nIt should be enabled on the reverse proxy.\n\nNo x-tenant header means that Horizon will load the root tenant context\n\n Here is an example architecture:\n\n In this architecture, the content of the x-tenant header is set by the reverse proxy based on the prefix before the evertrust.io domain, with a specific rule for the root domain.\n\n Root tenant\n\n The root tenant is the base tenant of a multi-tenant instance.\nIt has limited capabilities, mostly linked to user and tenant management.\n\nThe root tenant cannot access any of its tenant data, and can only manage tenants, not their data.\n\n Tenant management\n\n For tenant management, please refer to the Administration Guide\n\n Specific configuration\n\n On a multi-tenant instance, some system queues are shared across tenants.\nIf the instance sees heavy usage, the following parameters should be altered :\n\n The CRL cache synchronization parallelism and size\n\n The CRL database synchronization parallelism and size\n\n The default PKI queue parallelism and size\n\n Secrets\n\n On a multi-tenant instance, secrets for a tenant (credentials, private keys, …​) are encrypted using its own Tink keyset.\nThis keyset is itself encrypted with the instance keyset.\nThis ensures secrets are completely isolated from one tenant to another.\n\n Logging\n Endpoint configuration", + "content": "Multi-Tenancy\n\n Activation\n\n In order to activate multi-tenancy on an instance, a specific license must be used.\nContact the Evertrust team for access.\n\nMulti-tenancy must be enabled when provisioning a new instance, and cannot be disabled afterwards.\nThis means that switching an instance between multi-tenancy modes is not possible.\n\n Tenant isolation\n\n Horizon uses logical isolation, meaning that a single database is used for all tenants of an instance.\n\n To discriminate between tenants, Horizon uses the x-tenant header.\nUsing a header allows for a highly customizable tenant access model.\nIt should be enabled on the reverse proxy.\n\nNo x-tenant header means that Horizon will load the root tenant context\n\n Here is an example architecture:\n\n In this architecture, the content of the x-tenant header is set by the reverse proxy based on the prefix before the evertrust.io domain, with a specific rule for the root domain.\n\n Root tenant\n\n The root tenant is the base tenant of a multi-tenant instance.\nIt has limited capabilities, mostly linked to user and tenant management.\n\nThe root tenant cannot access any of its tenant data, and can only manage tenants, not their data.\n\n Tenant management\n\n For tenant management, please refer to the Administration Guide\n\n Specific configuration\n\n On a multi-tenant instance, some system queues are shared across tenants.\nIf the instance sees heavy usage, the following parameters should be altered :\n\n The CRL cache synchronization parallelism and size\n\n The CRL database synchronization parallelism and size\n\n The default PKI queue parallelism and size\n\n Secrets\n\n On a multi-tenant instance, secrets for a tenant (credentials, private keys, …​) are encrypted using its own Tink keyset.\nThis keyset is itself encrypted with the instance keyset.\nThis ensures secrets are completely isolated from one tenant to another.\n\n Logging\n\n On a multi-tenant instance, the tenant information can be added to logs.\n\n RPM\n\n Debian\n\n Kubernetes\n\n The tenant information is already added to standard logs if you are using the JSON or SYSLOG encoder.\n\n If you are using the standard line format, you can add the tenant information using the %contextTag{tenant} keyword anywhere in the pattern.\n\n To edit the pattern, follow the standard log_format \" class=\"xref page\">steps .\n\n The tenant information is already added to standard logs if you are using the JSON or SYSLOG encoder.\n\n If you are using the standard line format, you can add the tenant information using the %contextTag{tenant} keyword anywhere in the pattern.\n\n To edit the pattern, follow the standard log_format \" class=\"xref page\">steps .\n\n The tenant information is already added to standard logs if you are using the json format.\n\n However, if you are using the json_events logger, the tenant information is not added by default.\n\n To add it, one must modify the contents of the /horizon/etc/logback.xml file.\n\n The following modification should be applied to the contents of the json_events appender:\n\n <pattern>\n {\n \"event\": \"#asJson{%message}\",\n \"tenant\": \"%contextTag{tenant}\", (1)\n \"type\": \"event\"\n }\n</pattern>\n\n 1\n This line adds the tenant key to the JSON event logs, and outputs an empty string when no tenant is linked to this event.\n\n Logging\n Endpoint configuration", "keywords": [ "multi-tenancy", "install-guide", @@ -38712,7 +29469,7 @@ "Horizon 2.9.0 release notes" ], "summary": "Horizon 2.9.0 release notes Here are the release notes for EverTrust Horizon v2.9.0, released on 2026-03-13. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-541] - Added m", - "content": "Horizon 2.9.0 release notes\n\n Here are the release notes for EverTrust Horizon v2.9.0, released on 2026-03-13.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-541] - Added multi-tenancy support\n\n 2. Enhancements\n\n None\n\n 3. Bug Fixes\n\n None\n\n 4. Known Defects\n\n None\n\n 5. API modifications\n\n [HOR-541] - Renamed field tenant to azureTenant in AKV configuration objects ( Third Party AKV Connector , MDM Intune Connector , MDM Intune PKCS Connector )\n\n Horizon 2.9.1 release notes\n Configure tunnels", + "content": "Horizon 2.9.0 release notes\n\n Here are the release notes for EverTrust Horizon v2.9.0, released on 2026-03-13.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-541] - Added multi-tenancy support\n\n 2. Enhancements\n\n None\n\n 3. Bug Fixes\n\n None\n\n 4. Known Defects\n\n Due to a misconfiguration, CRL synchronization could stop updating and remain out of date. To fix this, add the following line to the added in the extra configuration : crl-task-dispatcher.thread-pool-executor.fixed-pool-size = 7 . This issue has been resolved in 2.9.2\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.9.3\n\n 5. API modifications\n\n [HOR-541] - Renamed field tenant to azureTenant in AKV configuration objects ( Third Party AKV Connector , MDM Intune Connector , MDM Intune PKCS Connector )\n\n Horizon 2.9.1 release notes\n Configure tunnels", "keywords": [ "horizon", "release", @@ -38738,7 +29495,7 @@ "Horizon 2.9.1 release notes" ], "summary": "Horizon 2.9.1 release notes Here are the release notes for EverTrust Horizon v2.9.1, released on 2026-04-27. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-1240] - Brainp", - "content": "Horizon 2.9.1 release notes\n\n Here are the release notes for EverTrust Horizon v2.9.1, released on 2026-04-27.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-1240] - Brainpool ECDSA elliptic curves (brainpoolp256r1, brainpoolp384r1, brainpoolp512r1) are now supported for certificate decoding, discovery, and enrollment options\n\n [HOR-1161] - SCEP MDM profiles for Intune now support POST as GET operations\n\n [HOR-1154] - A new Prometheus metric evertrust_horizon_maintenance_status is now exposed, indicating whether the instance is under maintenance\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HOR-1251] - Fixed an issue where loading a PKCS#11 wrapped Tink keyset could result in a fatal error when using specific HSMs\n\n [HOR-1149] - Fixed a UI issue where clicking the update action from the certificate detail page opened an update form in a modal instead of displaying a validation message\n\n [HOR-1041] - Fixed an issue where HCQL requests did not offer the correct choices after typing a compound query such as status is expired and valid.until\n\n [HOR-1039] - Fixed an issue where accessing the root URL of a multi-tenant instance in maintenance mode resulted in a timeout instead of redirecting to the maintenance page\n\n [HOR-995] - Fixed an issue where creating multiple Intune PKCS connectors with empty search filters was denied\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Horizon 2.9.2 release notes\n Horizon 2.9.0 release notes", + "content": "Horizon 2.9.1 release notes\n\n Here are the release notes for EverTrust Horizon v2.9.1, released on 2026-04-27.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-1240] - Brainpool ECDSA elliptic curves (brainpoolp256r1, brainpoolp384r1, brainpoolp512r1) are now supported for certificate decoding, discovery, and enrollment options\n\n [HOR-1161] - SCEP MDM profiles for Intune now support POST as GET operations\n\n [HOR-1154] - A new Prometheus metric evertrust_horizon_maintenance_status is now exposed, indicating whether the instance is under maintenance\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HOR-1251] - Fixed an issue where loading a PKCS#11 wrapped Tink keyset could result in a fatal error when using specific HSMs\n\n [HOR-1149] - Fixed a UI issue where clicking the update action from the certificate detail page opened an update form in a modal instead of displaying a validation message\n\n [HOR-1041] - Fixed an issue where HCQL requests did not offer the correct choices after typing a compound query such as status is expired and valid.until\n\n [HOR-1039] - Fixed an issue where accessing the root URL of a multi-tenant instance in maintenance mode resulted in a timeout instead of redirecting to the maintenance page\n\n [HOR-995] - Fixed an issue where creating multiple Intune PKCS connectors with empty search filters was denied\n\n 4. Known Defects\n\n Due to a misconfiguration, CRL synchronization could stop updating and remain out of date. To fix this, add the following line to the added in the extra configuration : crl-task-dispatcher.thread-pool-executor.fixed-pool-size = 7 . This issue has been resolved in 2.9.2\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.9.3\n\n 5. API modifications\n\n [None]\n\n Horizon 2.9.2 release notes\n Horizon 2.9.0 release notes", "keywords": [ "horizon", "release", @@ -38764,7 +29521,33 @@ "Horizon 2.9.2 release notes" ], "summary": "Horizon 2.9.2 release notes Here are the release notes for EverTrust Horizon v2.9.2, released on 2026-05-12. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", - "content": "Horizon 2.9.2 release notes\n\n Here are the release notes for EverTrust Horizon v2.9.2, released on 2026-05-12.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-546] - OIDC authentication now supports group mapping, allowing automatic assignment of roles and teams based on claims retrieved from the OIDC provider\n\n 3. Bug Fixes\n\n [HOR-1291] - Fixed a UI issue where default emails configured in ACME profiles were not persisted\n\n [HOR-1287] - Globalsign Atlas connector: fixed an issue where pending requests were considered as failed\n\n [HOR-1275] - Fixed an issue where horizon-config could not be run on Ubuntu\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Searching requests and certificates\n Horizon 2.9.1 release notes", + "content": "Horizon 2.9.2 release notes\n\n Here are the release notes for EverTrust Horizon v2.9.2, released on 2026-05-12.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-546] - OIDC authentication now supports group mapping, allowing automatic assignment of roles and teams based on claims retrieved from the OIDC provider\n\n 3. Bug Fixes\n\n [HOR-1291] - Fixed a UI issue where default emails configured in ACME profiles were not persisted\n\n [HOR-1287] - Globalsign Atlas connector: fixed an issue where pending requests were considered as failed\n\n [HOR-1275] - Fixed an issue where horizon-config could not be run on Ubuntu\n\n [HOR-1147] - Fixed a configuration issue that could cause CRL synchronization to stop running\n\n 4. Known Defects\n\n In rare cases, a new event can be inserted without the required synchronization data, which prevents the event analytics database from synchronizing and thus responding to any further requests. This issue has been resolved in 2.9.3\n\n 5. API modifications\n\n [None]\n\n Horizon 2.9.3 release notes\n Horizon 2.9.1 release notes", + "keywords": [ + "horizon", + "release", + "notes", + "release-notes", + "release-notes/2" + ] + }, + { + "page_id": "horizon:2.9:release-notes:2.9.3", + "product": "horizon", + "kind": "product", + "source": "antora", + "version": "2.9", + "title": "Horizon 2.9.3 release notes", + "section": "release-notes", + "slug": "release-notes/2.9.3", + "url": "https://docs.evertrust.fr/horizon/2.9/release-notes/2.9.3.html", + "canonical_url": "https://docs.evertrust.fr/horizon/2.9/release-notes/2.9.3.html", + "breadcrumbs": [ + "Horizon", + "Release notes", + "Horizon 2.9.3 release notes" + ], + "summary": "Horizon 2.9.3 release notes Here are the release notes for EverTrust Horizon v2.9.3, released on 2026-06-25. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", + "content": "Horizon 2.9.3 release notes\n\n Here are the release notes for EverTrust Horizon v2.9.3, released on 2026-06-25.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n The certificate CSV export now includes the OS and Path from the discovery data\n\n Improved compatibility for WCCE enrollment with fullResponse support\n\n 3. Bug Fixes\n\n Fixed an issue where renewal requests could not be opened when they were created through the API without using the module property\n\n Fixed an issue where the AKV renewal scheduled task filtered certificates by connector prefix, resulting in no renewal for these certificates\n\n Fixed an issue where OCSP requests could fail on OCSP responders that did not accept the Nonce extension as critical\n\n Fixed an issue where event analytics synchronization could fail\n\n Fixed an issue where the expiration parameter on the /api/v1/licenses route was incorrectly sent back as a string\n\n Fixed a UI issue where asynchronous notifications were not properly displayed on the Edit SCEP Profile page\n\n Fixed a UI issue where the Extensions card overflowed horizontally when displaying long values in the Crypto Decoder\n\n Fixed a UI issue where the \"Key Usages\" card was missing from the certificate \"More Details\" page\n\n Fixed a UI issue where a wrong HCQL suggestion for keyCategory was available\n\n Fixed a UI issue where the CA configuration dialog disappeared when modifying the Trusted for client authentication parameter\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n The expiration parameter on the /api/v1/licenses route is now correctly sent back as a number, as was the case on previous Horizon versions\n\n Searching requests and certificates\n Horizon 2.9.2 release notes", "keywords": [ "horizon", "release", @@ -38894,7 +29677,7 @@ "Searching requests and certificates" ], "summary": "Search Request Here is the section where you can search easily find all information regarding the request. How to do a simple request search 1. Log in to Horizon Registration Authority Interface 2. Access request search from the drawer: My ", - "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.9.2 release notes", + "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.9.3 release notes", "keywords": [ "searching", "requests", diff --git a/src/http/server.ts b/src/http/server.ts index d8c1e00..b73933e 100644 --- a/src/http/server.ts +++ b/src/http/server.ts @@ -5,6 +5,7 @@ import express, { type Request, type Response, } from 'express'; +import { rateLimit } from 'express-rate-limit'; import { randomUUID } from 'node:crypto'; import { readFileSync } from 'node:fs'; import { type Server, createServer as createHttpServer } from 'node:http'; @@ -95,6 +96,22 @@ export async function startHttpServer( const sessionLimiter = new RateLimiter(settings.rateLimitRps); const sinks = new Map(); + // Coarse per-IP backstop (defense-in-depth in front of the fine-grained init + // and per-session limiters). Keyed by the socket peer (Express trust proxy + // stays off); HORIZON_IP_RATE_LIMIT=0 disables it. + const ipLimiter = rateLimit({ + windowMs: 1000, + limit: settings.ipRateLimit > 0 ? settings.ipRateLimit : 1, + standardHeaders: true, + legacyHeaders: false, + skip: () => settings.ipRateLimit <= 0, + validate: false, + }); + + // Brief readiness cache so a burst of /readyz probes cannot hammer Horizon. + const READY_CACHE_MS = 10_000; + let readyCache: { at: number; healthy: boolean } | undefined; + const manager = new SessionManager({ maxSessions: settings.maxSessions, idleTtlMs: settings.sessionIdleTtl * 1000, @@ -409,25 +426,36 @@ export async function startHttpServer( res.status(200).json({ status: 'ok' }); }); - app.get('/readyz', async (req, res) => { + app.get('/readyz', ipLimiter, async (req, res) => { if (!hostOk(req)) { res.status(421).json({ status: 'misdirected' }); return; } - // Only service mode holds an env credential to probe Horizon with. + // Only service mode holds an env credential to probe Horizon with. The + // result is cached briefly so a burst of probes cannot hammer Horizon. if (config.authMode === 'service') { - const { auth } = buildSessionAuth({ kind: 'service' }, config, settings); - const probe = new HorizonClient(settings.url, auth, clientOptions); - try { - await probe.validateAuth(); - } catch { + const now = Date.now(); + if (!readyCache || now - readyCache.at >= READY_CACHE_MS) { + const { auth } = buildSessionAuth( + { kind: 'service' }, + config, + settings, + ); + const probe = new HorizonClient(settings.url, auth, clientOptions); + let healthy = true; + try { + await probe.validateAuth(); + } catch { + healthy = false; + } await probe.close().catch(() => undefined); await auth.cleanup().catch(() => undefined); + readyCache = { at: Date.now(), healthy }; + } + if (!readyCache.healthy) { res.status(503).json({ status: 'horizon-unreachable' }); return; } - await probe.close().catch(() => undefined); - await auth.cleanup().catch(() => undefined); } res.status(200).json({ status: 'ready' }); }); @@ -456,6 +484,7 @@ export async function startHttpServer( app.all( config.path, + ipLimiter, hostOriginGuard, jsonParser, async (req: Request, res: Response) => { diff --git a/src/settings.ts b/src/settings.ts index 69de8ff..f8c51b4 100644 --- a/src/settings.ts +++ b/src/settings.ts @@ -66,6 +66,7 @@ const settingsSchema = z.object({ sseMaxDuration: z.coerce.number().int().positive().default(3600), rateLimitRps: z.coerce.number().int().nonnegative().default(20), initRateLimit: z.coerce.number().int().nonnegative().default(5), + ipRateLimit: z.coerce.number().int().nonnegative().default(600), // -- Inbound mTLS (only when HORIZON_HTTP_AUTH_MODE=mtls) ---------------- httpTlsCert: z.string().default(''), diff --git a/tests/unit/http-server.integration.test.ts b/tests/unit/http-server.integration.test.ts index b8601c2..934855f 100644 --- a/tests/unit/http-server.integration.test.ts +++ b/tests/unit/http-server.integration.test.ts @@ -297,3 +297,39 @@ describe('HTTP server integration (no leak on a rejected initialize)', () => { } }, 20000); }); + +describe('HTTP server integration (readyz probe cache)', () => { + it('caches the /readyz Horizon probe in service mode', async () => { + const port = await freePort(); + const env = { + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'service', + HORIZON_URL: 'https://horizon.test', + HORIZON_API_ID: 'svc', + HORIZON_API_KEY: 'k', + HORIZON_HTTP_HOST: '127.0.0.1', + HORIZON_HTTP_PORT: String(port), + HORIZON_TRUSTED_HOSTS: `127.0.0.1:${port}`, + HORIZON_VERIFY_SSL: 'false', + }; + const settings = loadSettings(env); + const config = buildHttpConfig(settings, env); + const handle = await startHttpServer(settings, config); + const base = `http://127.0.0.1:${handle.port}/readyz`; + const probes = () => + mockFetch.mock.calls.filter((c) => + String(c[0]).includes('/api/v1/security/principals/self'), + ).length; + try { + const before = probes(); + const r1 = await fetch(base); + const r2 = await fetch(base); + expect(r1.status).toBe(200); + expect(r2.status).toBe(200); + // Two probes within the cache window trigger only one Horizon whoami. + expect(probes() - before).toBe(1); + } finally { + await handle.close(); + } + }, 20000); +}); diff --git a/tests/unit/settings.test.ts b/tests/unit/settings.test.ts index 1fa1b45..773d44c 100644 --- a/tests/unit/settings.test.ts +++ b/tests/unit/settings.test.ts @@ -192,6 +192,7 @@ describe('loadSettings', () => { expect(s.sseMaxDuration).toBe(3600); expect(s.rateLimitRps).toBe(20); expect(s.initRateLimit).toBe(5); + expect(s.ipRateLimit).toBe(600); expect(s.httpTlsCert).toBe(''); expect(s.httpTlsKey).toBe(''); expect(s.inboundCertHeader).toBe(''); From 701aae58b76080e104166cf874a723d063353f1a Mon Sep 17 00:00:00 2001 From: Souf Date: Wed, 1 Jul 2026 11:44:25 +0200 Subject: [PATCH 03/12] test: stop the live tool-selection eval once the primary tool is selected --- tests/llm-live/runner.ts | 25 +++++++++++++++++++++++++ tests/llm-live/tool-selection.test.ts | 5 +++++ 2 files changed, 30 insertions(+) diff --git a/tests/llm-live/runner.ts b/tests/llm-live/runner.ts index ed804c9..75684fe 100644 --- a/tests/llm-live/runner.ts +++ b/tests/llm-live/runner.ts @@ -35,6 +35,16 @@ export interface RunScenarioOptions { readonly model?: string; readonly maxTurns?: number; readonly maxBudgetUsd?: number; + /** + * Stop the agent loop as soon as one of these Horizon MCP tools is selected. + * The tool-selection assertion only needs the FIRST acceptable primary tool + * (its input is captured at the tool_use block, before execution) plus its + * benign preceders, so stopping there avoids running the full multi-turn + * answer - which otherwise makes long scenarios (e.g. one that enumerates + * every team's members) flaky under the suite's parallel load, and needlessly + * bills the trailing paid turns. + */ + readonly stopWhenToolCalled?: readonly string[]; } function buildMcpEnv(): Record { @@ -150,12 +160,18 @@ export async function runScenarioWithClaude( }, }; + const stopSet = + options.stopWhenToolCalled && options.stopWhenToolCalled.length > 0 + ? new Set(options.stopWhenToolCalled) + : undefined; + const q = query({ prompt, options: sdkOptions }); try { for await (const msg of q as AsyncIterable) { if (msg.type === 'assistant' && msg.message?.content) { if (msg.error) errors.push(`assistant_error:${msg.error}`); + let reachedStopTool = false; for (const block of msg.message.content) { if (block.type === 'tool_use') { const isMcp = block.name.startsWith(MCP_TOOL_PREFIX); @@ -169,11 +185,20 @@ export async function runScenarioWithClaude( display, (block.input ?? {}) as Record, ); + if (stopSet?.has(display)) reachedStopTool = true; } } else if (block.type === 'text') { assistantTextChunks.push(block.text); } } + // Early-exit: the primary tool has been selected (with its input + // captured). The assertion needs nothing after it, so stop the loop - + // and the paid trailing turns - here rather than running the full + // multi-turn answer. + if (reachedStopTool) { + stopReason = 'stopped_at_primary_tool'; + break; + } } else if (msg.type === 'result') { turns = msg.num_turns; totalCostUsd = msg.total_cost_usd; diff --git a/tests/llm-live/tool-selection.test.ts b/tests/llm-live/tool-selection.test.ts index 9e029c1..d5e0034 100644 --- a/tests/llm-live/tool-selection.test.ts +++ b/tests/llm-live/tool-selection.test.ts @@ -52,6 +52,11 @@ describe.skipIf(SKIP)( const result = await runScenarioWithClaude(scenario.question, { model: process.env['HORIZON_LLM_LIVE_MODEL'] ?? 'claude-haiku-4-5', maxBudgetUsd: scenario.maxBudgetUsd, + // Stop as soon as the expected tool is selected: the assertion only + // inspects the first acceptable primary tool and its preceders, so + // running the full multi-turn answer just adds latency (and cost) + // and makes long scenarios flaky under the suite's parallel load. + stopWhenToolCalled: scenario.acceptablePrimaryTools, }); expect( From 3169512a2ec9a5d72c723c6203dc505380308540 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 2 Jul 2026 12:29:48 +0200 Subject: [PATCH 04/12] fix: harden HTTP transport (SSE idle, readyz single-flight, bounded shutdown, cleartext guard) --- src/http/config.ts | 40 ++++++ src/http/rate-limit.ts | 18 ++- src/http/server.ts | 153 ++++++++++++++++----- src/http/session-manager.ts | 30 +++- tests/unit/http-config.test.ts | 68 ++++++++- tests/unit/http-rate-limit.test.ts | 30 ++++ tests/unit/http-server.integration.test.ts | 64 +++++++++ tests/unit/http-session-manager.test.ts | 43 ++++++ 8 files changed, 404 insertions(+), 42 deletions(-) diff --git a/src/http/config.ts b/src/http/config.ts index 95c2889..30028e1 100644 --- a/src/http/config.ts +++ b/src/http/config.ts @@ -282,6 +282,23 @@ export function buildHttpConfig( const allowedOrigins = deriveAllowedOrigins(settings); const mtls = resolveAuthMode(settings); + // Fail closed: api-key mode carries per-caller credentials in request + // headers, so a cleartext http endpoint on a non-loopback bind would leak + // them on the wire. An https public URL (a TLS-terminating proxy in front) + // is the supported way to run non-loopback. + if ( + settings.httpAuthMode === 'api-key' && + !isLoopbackHost(settings.httpHost) && + (publicUrl ? publicUrl.protocol !== 'https:' : true) + ) { + fail( + `api-key auth mode on non-loopback host "${settings.httpHost}" would ` + + `expose per-caller credentials over cleartext http. Terminate TLS ` + + `(set HORIZON_PUBLIC_URL to an https origin behind a TLS-terminating ` + + `proxy) or bind to loopback.`, + ); + } + return { host: settings.httpHost, port: settings.httpPort, @@ -293,3 +310,26 @@ export function buildHttpConfig( ...(mtls ? { mtls } : {}), }; } + +/** + * A single prominent startup warning for service auth mode on a non-loopback + * bind: the endpoint is an unauthenticated proxy that acts with the server's + * Horizon identity, so it must be protected by network placement or an + * authenticating edge. Returns undefined when no warning applies. + */ +export function serviceExposureWarning( + settings: HorizonSettings, +): string | undefined { + if ( + settings.httpAuthMode === 'service' && + !isLoopbackHost(settings.httpHost) + ) { + return ( + `service auth mode on non-loopback host "${settings.httpHost}": this ` + + `endpoint is an UNAUTHENTICATED proxy that acts with the server's ` + + `Horizon identity. Any caller that can reach it acts as that identity. ` + + `Protect it by network placement or an authenticating edge.` + ); + } + return undefined; +} diff --git a/src/http/rate-limit.ts b/src/http/rate-limit.ts index 79eac20..5622d97 100644 --- a/src/http/rate-limit.ts +++ b/src/http/rate-limit.ts @@ -14,8 +14,16 @@ export class RateLimiter { constructor( private readonly limit: number, private readonly now: () => number = Date.now, + // Per-key ceilings that override the base limit (e.g. a global key that + // caps aggregate traffic above the per-peer limit). A base limit of 0 + // still disables the limiter entirely, overrides included. + private readonly overrides: Readonly> = {}, ) {} + private limitFor(key: string): number { + return this.overrides[key] ?? this.limit; + } + private windowFor(key: string, t: number): Window { let w = this.windows.get(key); if (!w || t - w.start >= 1000) { @@ -29,7 +37,7 @@ export class RateLimiter { tryAcquire(key: string, cost = 1): boolean { if (this.limit <= 0) return true; const w = this.windowFor(key, this.now()); - if (w.count + cost > this.limit) return false; + if (w.count + cost > this.limitFor(key)) return false; w.count += cost; return true; } @@ -42,9 +50,11 @@ export class RateLimiter { tryAcquireAll(keys: readonly string[], cost = 1): boolean { if (this.limit <= 0) return true; const t = this.now(); - const targets = keys.map((k) => this.windowFor(k, t)); - if (targets.some((w) => w.count + cost > this.limit)) return false; - for (const w of targets) w.count += cost; + const targets = keys.map((k) => ({ key: k, w: this.windowFor(k, t) })); + if (targets.some(({ key, w }) => w.count + cost > this.limitFor(key))) { + return false; + } + for (const { w } of targets) w.count += cost; return true; } diff --git a/src/http/server.ts b/src/http/server.ts index b73933e..1ce7f0c 100644 --- a/src/http/server.ts +++ b/src/http/server.ts @@ -17,7 +17,7 @@ import { HorizonClient } from '../client/http.js'; import { getLogger, runWithLoggingSink } from '../logging.js'; import { createSessionServer } from '../server-factory.js'; import type { HorizonSettings } from '../settings.js'; -import type { HttpConfig } from './config.js'; +import { type HttpConfig, serviceExposureWarning } from './config.js'; import { CredentialError, buildSessionAuth, @@ -92,7 +92,15 @@ export async function startHttpServer( config.mtls?.inbound?.header ?? '', ]); - const initLimiter = new RateLimiter(settings.initRateLimit); + // The init limiter enforces a per-remote-address cap AND an aggregate cap via + // a shared '__global__' key. Give the global key a higher ceiling (a multiple + // of the per-peer limit) so a single peer stays capped while total server + // throughput is not artificially pinned to one peer's budget. + const GLOBAL_INIT_KEY = '__global__'; + const GLOBAL_INIT_MULTIPLIER = 4; + const initLimiter = new RateLimiter(settings.initRateLimit, undefined, { + [GLOBAL_INIT_KEY]: settings.initRateLimit * GLOBAL_INIT_MULTIPLIER, + }); const sessionLimiter = new RateLimiter(settings.rateLimitRps); const sinks = new Map(); @@ -109,8 +117,43 @@ export async function startHttpServer( }); // Brief readiness cache so a burst of /readyz probes cannot hammer Horizon. + // A single in-flight probe is shared by concurrent callers (single-flight), + // so a simultaneous burst triggers exactly one upstream validateAuth. const READY_CACHE_MS = 10_000; let readyCache: { at: number; healthy: boolean } | undefined; + let readyInflight: Promise | undefined; + + async function probeHorizon(): Promise { + const { auth } = buildSessionAuth({ kind: 'service' }, config, settings); + const probe = new HorizonClient(settings.url, auth, clientOptions); + let healthy = true; + try { + await probe.validateAuth(); + } catch { + healthy = false; + } + await probe.close().catch(() => undefined); + await auth.cleanup().catch(() => undefined); + return healthy; + } + + async function ensureReady(): Promise { + const now = Date.now(); + if (readyCache && now - readyCache.at < READY_CACHE_MS) { + return readyCache.healthy; + } + if (!readyInflight) { + readyInflight = probeHorizon() + .then((healthy) => { + readyCache = { at: Date.now(), healthy }; + return healthy; + }) + .finally(() => { + readyInflight = undefined; + }); + } + return readyInflight; + } const manager = new SessionManager({ maxSessions: settings.maxSessions, @@ -147,14 +190,18 @@ export async function startHttpServer( }; } + // -32600 (Invalid Request) for genuinely malformed requests; -32000 (server + // error range) for server-side rejections (rate limit, auth mismatch). The + // id echoes the request's own id whenever the body was parsed. function sendError( res: Response, status: number, id: JsonRpcId | undefined, message: string, + code = -32600, ): void { if (!res.headersSent) { - res.status(status).json(jsonRpcErrorBody(id, -32600, message)); + res.status(status).json(jsonRpcErrorBody(id, code, message)); } } @@ -164,7 +211,7 @@ export async function startHttpServer( id: JsonRpcId | undefined, ): void { if (err instanceof CredentialError) { - sendError(res, err.status, id, err.message); + sendError(res, err.status, id, err.message, -32000); return; } throw err; @@ -178,16 +225,17 @@ export async function startHttpServer( fingerprint: string | undefined, ): boolean { if (!fingerprint) return true; // service mode: no per-caller binding + const id = firstId(req.body); let material; try { material = extractCredential(req, config); } catch (err) { - handleCredentialError(res, err, null); + handleCredentialError(res, err, id); return false; } const fp = credentialFingerprintOf(material); if (!fp || !fingerprintsMatch(fp, fingerprint)) { - sendError(res, 401, null, 'session credential does not match'); + sendError(res, 401, id, 'session credential does not match', -32000); return false; } return true; @@ -217,15 +265,21 @@ export async function startHttpServer( } const peer = req.socket.remoteAddress ?? 'unknown'; - if (!initLimiter.tryAcquireAll(['__global__', peer])) { - sendError(res, 429, firstId(body), 'too many initialization attempts'); + if (!initLimiter.tryAcquireAll([GLOBAL_INIT_KEY, peer])) { + sendError( + res, + 429, + firstId(body), + 'too many initialization attempts', + -32000, + ); return; } // Reserve capacity atomically: the session is only registered later, inside // onsessioninitialized, after the validateAuth + connect awaits below, so a // plain canCreate() check would let concurrent initializes overshoot. if (!manager.tryReserve()) { - sendError(res, 503, firstId(body), 'maximum sessions reached'); + sendError(res, 503, firstId(body), 'maximum sessions reached', -32000); return; } @@ -262,11 +316,15 @@ export async function startHttpServer( status, firstId(body), status === 502 ? 'horizon unreachable' : 'authentication failed', + -32000, ); return; } - mcp = createSessionServer(client); + mcp = createSessionServer(client, { + enabledToolsets: settings.enabledToolsets, + readOnly: settings.readOnly, + }); // const aliases so the closure sees definitely-assigned values. const sessionClient = client; const sessionAuth = auth; @@ -321,13 +379,16 @@ export async function startHttpServer( res: Response, sessionId: string, ): Promise { - const record = manager.get(sessionId); + // Look up WITHOUT refreshing the idle timer: only an authenticated caller + // (fingerprint check below) should keep the session alive. + const record = manager.peek(sessionId); if (!record) { - sendError(res, 404, null, 'session not found'); + sendError(res, 404, firstId(req.body), 'session not found'); return; } if (!ensureFingerprintBinding(req, res, record.credentialFingerprint)) return; + manager.touch(sessionId); const body: unknown = req.body; const methods = methodsOf(body); @@ -349,7 +410,7 @@ export async function startHttpServer( messageCount > 0 && !sessionLimiter.tryAcquire(sessionId, messageCount) ) { - sendError(res, 429, firstId(body), 'rate limit exceeded'); + sendError(res, 429, firstId(body), 'rate limit exceeded', -32000); return; } @@ -358,7 +419,13 @@ export async function startHttpServer( ); if (isWork) { if (!manager.reserveInflight(sessionId)) { - sendError(res, 429, firstId(body), 'too many in-flight tool calls'); + sendError( + res, + 429, + firstId(body), + 'too many in-flight tool calls', + -32000, + ); return; } const release = once(() => manager.releaseInflight(sessionId)); @@ -396,6 +463,12 @@ export async function startHttpServer( if (req.method === 'GET') { res.setTimeout(settings.sseMaxDuration * 1000); + // A standalone SSE stream refreshes lastSeenAt only at open; count it as + // an active stream so the idle sweep does not reap the live connection. + manager.addStream(sessionId); + const release = once(() => manager.removeStream(sessionId)); + res.on('close', release); + res.on('finish', release); } const sink = sinks.get(sessionId) ?? makeSink(record.server as unknown as McpServer); @@ -418,7 +491,7 @@ export async function startHttpServer( // Health endpoints: unauthenticated, exempt from session/rate machinery, // still Host-validated. - app.get('/healthz', (req, res) => { + app.get('/healthz', ipLimiter, (req, res) => { if (!hostOk(req)) { res.status(421).json({ status: 'misdirected' }); return; @@ -432,27 +505,11 @@ export async function startHttpServer( return; } // Only service mode holds an env credential to probe Horizon with. The - // result is cached briefly so a burst of probes cannot hammer Horizon. + // result is cached briefly and single-flighted so a burst of probes cannot + // hammer Horizon. if (config.authMode === 'service') { - const now = Date.now(); - if (!readyCache || now - readyCache.at >= READY_CACHE_MS) { - const { auth } = buildSessionAuth( - { kind: 'service' }, - config, - settings, - ); - const probe = new HorizonClient(settings.url, auth, clientOptions); - let healthy = true; - try { - await probe.validateAuth(); - } catch { - healthy = false; - } - await probe.close().catch(() => undefined); - await auth.cleanup().catch(() => undefined); - readyCache = { at: Date.now(), healthy }; - } - if (!readyCache.healthy) { + const healthy = await ensureReady(); + if (!healthy) { res.status(503).json({ status: 'horizon-unreachable' }); return; } @@ -548,6 +605,15 @@ export async function startHttpServer( ) : createHttpServer(app); + // Slowloris guard on request headers. requestTimeout is disabled because it + // bounds the time to receive the WHOLE request, which would kill long-lived + // SSE GET streams (up to sseMaxDuration) and slow tool calls (CSV exports up + // to exportTimeout); the response side is bounded by res.setTimeout instead. + // keepAliveTimeout sits a few seconds over the Node default. + httpServer.headersTimeout = 60_000; + httpServer.requestTimeout = 0; + httpServer.keepAliveTimeout = 10_000; + await new Promise((resolve, reject) => { httpServer.once('error', reject); httpServer.listen(config.port, config.host, () => { @@ -582,6 +648,14 @@ export async function startHttpServer( `(auth mode: ${config.authMode}, public: ${config.publicEndpoint})`, ); + const exposureWarning = serviceExposureWarning(settings); + if (exposureWarning) logger.warning(exposureWarning); + + // Bound graceful shutdown: closeAllConnections() drops idle keep-alive + // sockets that would otherwise keep httpServer.close() pending indefinitely, + // and the race caps the drain so SIGTERM never hangs until SIGKILL. + const CLOSE_TIMEOUT_MS = 5000; + return { port: boundPort, url: config.publicEndpoint, @@ -592,7 +666,14 @@ export async function startHttpServer( httpServer.close(() => resolve()), ); await manager.shutdownAll(); - await closed; + httpServer.closeAllConnections?.(); + await Promise.race([ + closed, + new Promise((resolve) => { + const t = setTimeout(resolve, CLOSE_TIMEOUT_MS); + t.unref?.(); + }), + ]); }, }; } diff --git a/src/http/session-manager.ts b/src/http/session-manager.ts index 22b762b..2b1d89a 100644 --- a/src/http/session-manager.ts +++ b/src/http/session-manager.ts @@ -16,6 +16,8 @@ export interface SessionRecord extends SessionResources { lastSeenAt: number; closed: boolean; inflight: number; + /** Open standalone SSE streams; a positive count defers the idle sweep. */ + activeStreams: number; } export interface SessionManagerOptions { @@ -99,6 +101,7 @@ export class SessionManager { lastSeenAt: t, closed: false, inflight: 0, + activeStreams: 0, }; this.sessions.set(input.sessionId, record); return record; @@ -116,6 +119,27 @@ export class SessionManager { return this.sessions.get(sessionId); } + /** Refresh a session's idle timer without returning the record. */ + touch(sessionId: string): void { + const record = this.sessions.get(sessionId); + if (record) record.lastSeenAt = this.now(); + } + + /** Mark a standalone SSE stream as attached (defers the idle sweep). */ + addStream(sessionId: string): void { + const record = this.sessions.get(sessionId); + if (record) record.activeStreams += 1; + } + + /** Detach a standalone SSE stream and restart the idle timer from now. */ + removeStream(sessionId: string): void { + const record = this.sessions.get(sessionId); + if (record) { + record.activeStreams = Math.max(0, record.activeStreams - 1); + record.lastSeenAt = this.now(); + } + } + markReady(sessionId: string): void { const record = this.sessions.get(sessionId); if (record) record.state = 'ready'; @@ -189,7 +213,11 @@ export class SessionManager { if (record.closed) continue; const idle = t - record.lastSeenAt; const age = t - record.createdAt; - if (idle >= this.opts.idleTtlMs || age >= this.opts.absTtlMs) { + // An attached SSE stream defers the idle sweep (the stream refreshes + // lastSeenAt only at open), but the absolute TTL still reaps the session. + const idleExpired = + idle >= this.opts.idleTtlMs && record.activeStreams === 0; + if (idleExpired || age >= this.opts.absTtlMs) { expired.push(id); } } diff --git a/tests/unit/http-config.test.ts b/tests/unit/http-config.test.ts index eb22cc5..03fad95 100644 --- a/tests/unit/http-config.test.ts +++ b/tests/unit/http-config.test.ts @@ -1,6 +1,9 @@ import { describe, expect, it } from 'vitest'; -import { buildHttpConfig } from '../../src/http/config.js'; +import { + buildHttpConfig, + serviceExposureWarning, +} from '../../src/http/config.js'; import { loadSettings } from '../../src/settings.js'; /** @@ -40,8 +43,10 @@ describe('buildHttpConfig', () => { }); it('allows a non-loopback bind when trusted hosts are given', () => { + // https public URL keeps api-key mode off the cleartext guard. const cfg = build({ HORIZON_HTTP_HOST: '0.0.0.0', + HORIZON_PUBLIC_URL: 'https://mcp.example.com', HORIZON_TRUSTED_HOSTS: 'mcp.example.com', }); expect(cfg.allowedHosts).toEqual(new Set(['mcp.example.com'])); @@ -262,6 +267,67 @@ describe('buildHttpConfig', () => { }); }); + describe('api-key cleartext guard', () => { + it('refuses api-key mode on a non-loopback bind with a cleartext http endpoint', () => { + expect(() => + build({ + HORIZON_HTTP_HOST: '0.0.0.0', + HORIZON_TRUSTED_HOSTS: 'mcp.example.com', + }), + ).toThrow(/cleartext|http|TLS/i); + }); + + it('allows api-key mode on loopback over http', () => { + expect(() => build({ HORIZON_HTTP_HOST: '127.0.0.1' })).not.toThrow(); + }); + + it('allows api-key mode on a non-loopback bind behind an https public URL', () => { + const cfg = build({ + HORIZON_HTTP_HOST: '0.0.0.0', + HORIZON_PUBLIC_URL: 'https://mcp.example.com', + }); + expect(cfg.authMode).toBe('api-key'); + }); + }); + + describe('service-mode exposure warning', () => { + function svcSettings(env: Record) { + const full = { + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'service', + HORIZON_API_ID: 'id', + HORIZON_API_KEY: 'key', + HORIZON_TRUSTED_HOSTS: 'mcp.example.com', + ...env, + }; + return loadSettings(full); + } + + it('warns when service mode binds a non-loopback host', () => { + const warning = serviceExposureWarning( + svcSettings({ + HORIZON_HTTP_HOST: '0.0.0.0', + }), + ); + expect(warning).toMatch(/unauthenticated|proxy/i); + }); + + it('does not warn when service mode binds loopback', () => { + expect( + serviceExposureWarning(svcSettings({ HORIZON_HTTP_HOST: '127.0.0.1' })), + ).toBeUndefined(); + }); + + it('does not warn for api-key mode on a non-loopback bind', () => { + const settings = loadSettings({ + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'api-key', + HORIZON_HTTP_HOST: '0.0.0.0', + }); + expect(serviceExposureWarning(settings)).toBeUndefined(); + }); + }); + describe('fail-closed extras', () => { it('rejects HORIZON_ALLOW_PRIVATE_TLS_PROBE=1 in HTTP mode', () => { expect(() => build({ HORIZON_ALLOW_PRIVATE_TLS_PROBE: '1' })).toThrow( diff --git a/tests/unit/http-rate-limit.test.ts b/tests/unit/http-rate-limit.test.ts index 83e4581..a9b2e4a 100644 --- a/tests/unit/http-rate-limit.test.ts +++ b/tests/unit/http-rate-limit.test.ts @@ -72,6 +72,36 @@ describe('RateLimiter', () => { }); }); + describe('per-key limit overrides', () => { + it('gives an overridden key a higher ceiling than the base limit', () => { + const clock = fakeClock(); + // per-peer base limit 1, global key ceiling 4. + const rl = new RateLimiter(1, clock.now, { __global__: 4 }); + // Distinct peers each get 1, while the global key absorbs up to 4. + expect(rl.tryAcquireAll(['__global__', 'a'])).toBe(true); + expect(rl.tryAcquireAll(['__global__', 'b'])).toBe(true); + expect(rl.tryAcquireAll(['__global__', 'c'])).toBe(true); + expect(rl.tryAcquireAll(['__global__', 'd'])).toBe(true); + // Global key is now full at 4 -> a fresh peer is still denied. + expect(rl.tryAcquireAll(['__global__', 'e'])).toBe(false); + }); + + it('still caps a single peer at the base limit even below the global ceiling', () => { + const clock = fakeClock(); + const rl = new RateLimiter(1, clock.now, { __global__: 4 }); + expect(rl.tryAcquireAll(['__global__', 'a'])).toBe(true); + // 'a' is full at the per-peer limit of 1 while global still has room. + expect(rl.tryAcquireAll(['__global__', 'a'])).toBe(false); + }); + + it('disables everything when the base limit is 0 regardless of overrides', () => { + const rl = new RateLimiter(0, undefined, { __global__: 4 }); + for (let i = 0; i < 10; i++) { + expect(rl.tryAcquireAll(['__global__', 'a'])).toBe(true); + } + }); + }); + describe('prune', () => { it('evicts windows whose period has elapsed (bounds the key map)', () => { const clock = fakeClock(); diff --git a/tests/unit/http-server.integration.test.ts b/tests/unit/http-server.integration.test.ts index 934855f..132de19 100644 --- a/tests/unit/http-server.integration.test.ts +++ b/tests/unit/http-server.integration.test.ts @@ -1,4 +1,5 @@ import { createServer } from 'node:http'; +import { connect } from 'node:net'; import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'; // Mock undici (the SERVER's Horizon client). The MCP CLIENT transport uses the @@ -192,6 +193,14 @@ describe('HTTP server integration (api-key mode)', () => { body: JSON.stringify({ jsonrpc: '2.0', id: 99, method: 'tools/list' }), }); expect(res.status).toBe(401); + // The transport-level error echoes the request id and uses the server-error + // code (-32000) rather than the generic invalid-request -32600. + const err = (await res.json()) as { + id: number; + error: { code: number }; + }; + expect(err.id).toBe(99); + expect(err.error.code).toBe(-32000); }, 20000); it('tears down all sessions on close', async () => { @@ -332,4 +341,59 @@ describe('HTTP server integration (readyz probe cache)', () => { await handle.close(); } }, 20000); + + it('single-flights a concurrent burst of /readyz probes into one Horizon call', async () => { + const port = await freePort(); + const env = { + HORIZON_TRANSPORT: 'http', + HORIZON_HTTP_AUTH_MODE: 'service', + HORIZON_URL: 'https://horizon.test', + HORIZON_API_ID: 'svc', + HORIZON_API_KEY: 'k', + HORIZON_HTTP_HOST: '127.0.0.1', + HORIZON_HTTP_PORT: String(port), + HORIZON_TRUSTED_HOSTS: `127.0.0.1:${port}`, + HORIZON_VERIFY_SSL: 'false', + HORIZON_IP_RATE_LIMIT: '0', + }; + const settings = loadSettings(env); + const config = buildHttpConfig(settings, env); + const handle = await startHttpServer(settings, config); + const base = `http://127.0.0.1:${handle.port}/readyz`; + const probes = () => + mockFetch.mock.calls.filter((c) => + String(c[0]).includes('/api/v1/security/principals/self'), + ).length; + try { + const before = probes(); + const results = await Promise.all( + Array.from({ length: 5 }, () => fetch(base)), + ); + for (const r of results) expect(r.status).toBe(200); + // Five simultaneous probes share a single in-flight Horizon whoami. + expect(probes() - before).toBe(1); + } finally { + await handle.close(); + } + }, 20000); +}); + +describe('HTTP server integration (graceful shutdown)', () => { + it('resolves close() promptly despite a lingering idle keep-alive socket', async () => { + const ctx = await startApiKeyServer(); + const sock = connect(ctx.handle.port, '127.0.0.1'); + await new Promise((resolve, reject) => { + sock.once('connect', () => resolve()); + sock.once('error', reject); + }); + try { + const start = Date.now(); + await ctx.handle.close(); + // Without closeAllConnections()/timeout, close() would hang on the idle + // socket until SIGKILL; the bounded drain keeps it well under the cap. + expect(Date.now() - start).toBeLessThan(2000); + } finally { + sock.destroy(); + } + }, 20000); }); diff --git a/tests/unit/http-session-manager.test.ts b/tests/unit/http-session-manager.test.ts index a99fb92..feea7ea 100644 --- a/tests/unit/http-session-manager.test.ts +++ b/tests/unit/http-session-manager.test.ts @@ -190,6 +190,49 @@ describe('sweepExpired', () => { }); }); +describe('active stream keeps a session alive past idle TTL', () => { + it('skips idle sweep while a stream is attached but still honors absolute TTL', async () => { + let t = 1000; + const mgr = makeManager({ + idleTtlMs: 100, + absTtlMs: 10_000, + now: () => t, + }); + add(mgr, 's1'); + mgr.addStream('s1'); + t = 1500; // idle 500 >= 100, but a stream is attached -> not swept + expect(await mgr.sweepExpired()).toEqual([]); + }); + + it('reaps a streaming session once the absolute TTL is reached', async () => { + let t = 1000; + const mgr = makeManager({ idleTtlMs: 100, absTtlMs: 500, now: () => t }); + const r = add(mgr, 's1'); + mgr.addStream('s1'); + t = 1600; // age 600 >= 500 absolute TTL fires despite the open stream + expect(await mgr.sweepExpired()).toEqual(['s1']); + expect(r.calls.server).toBe(1); + }); + + it('sweeps normally after the stream closes', async () => { + let t = 1000; + const mgr = makeManager({ + idleTtlMs: 100, + absTtlMs: 10_000, + now: () => t, + }); + add(mgr, 's1'); + mgr.addStream('s1'); + t = 5000; + expect(await mgr.sweepExpired()).toEqual([]); // survives while streaming + mgr.removeStream('s1'); // refreshes lastSeenAt at t=5000 + t = 5050; + expect(await mgr.sweepExpired()).toEqual([]); // idle 50 < 100 + t = 5200; + expect(await mgr.sweepExpired()).toEqual(['s1']); // idle 200 >= 100 + }); +}); + describe('shutdownAll', () => { it('tears down every live session', async () => { const mgr = makeManager(); From 0632e75e6e6633d819e974a5afbdd45face1c854 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 2 Jul 2026 12:30:01 +0200 Subject: [PATCH 05/12] fix: correct tool accuracy, drop dead taskSupport wiring, window doc output --- src/client/errors.ts | 2 +- src/resources/catalog.ts | 30 ++++ src/resources/knowledge/server_rules.md | 9 +- src/tools/assist/system.ts | 43 +++-- src/tools/docs.ts | 166 ++++++++++++++++++- src/tools/helpers.ts | 1 - src/tools/lifecycle/certificates.ts | 37 ++--- src/tools/lifecycle/events.ts | 11 +- src/tools/lifecycle/requests.ts | 27 ++- src/tools/register.ts | 62 +++---- tests/unit/__snapshots__/golden.test.ts.snap | 37 +++++ tests/unit/docs.test.ts | 91 ++++++++++ tests/unit/golden.test.ts | 19 ++- tests/unit/helpers.test.ts | 12 +- tests/unit/tool-dispatch.test.ts | 67 ++++++++ tests/unit/tools.test.ts | 58 +++++-- 16 files changed, 553 insertions(+), 119 deletions(-) create mode 100644 tests/unit/tool-dispatch.test.ts diff --git a/src/client/errors.ts b/src/client/errors.ts index 702da99..fdab5c8 100644 --- a/src/client/errors.ts +++ b/src/client/errors.ts @@ -28,7 +28,7 @@ const SPECIFIC_REMEDIATION: Record = { SecAuth001: 'Authentication failed. Check credentials - ' + 'HORIZON_API_ID/HORIZON_API_KEY for API key auth, ' + - 'client certificate for mTLS, or re-authenticate via browser.', + 'or the client certificate configuration for mTLS.', SecPerm001: 'Insufficient permissions. Check role assignments for the authenticated principal.', }; diff --git a/src/resources/catalog.ts b/src/resources/catalog.ts index ec95ba5..6c7ffc6 100644 --- a/src/resources/catalog.ts +++ b/src/resources/catalog.ts @@ -298,5 +298,35 @@ export function getResourceByUri(uri: string): ResourceEntry | undefined { return getAllResources().find((r) => r.uri === uri); } +/** + * Slugs of the top-level knowledge topics and playbooks (no split-section + * entries). Each slug maps to the URI `horizon://knowledge/`. + */ +export function getKnowledgeTopicSlugs(): string[] { + return [...CORE_RESOURCES, ...CURATED_RESOURCES].map((r) => r.name); +} + +/** Section slugs available under a top-level topic (empty when none). */ +export function getKnowledgeSectionSlugs(topic: string): string[] { + const prefix = `horizon://knowledge/${topic}/`; + return getAllResources() + .filter((r) => r.uri.startsWith(prefix)) + .map((r) => r.uri.slice(prefix.length)); +} + +/** + * Resolve knowledge content by topic slug and optional section slug. Returns + * undefined when the topic (or the topic+section pair) is unknown. + */ +export function resolveKnowledge( + topic: string, + section?: string, +): ResourceEntry | undefined { + const uri = section + ? `horizon://knowledge/${topic}/${section}` + : `horizon://knowledge/${topic}`; + return getResourceByUri(uri); +} + /** URI template that covers split-section resources. */ export const SECTION_URI_TEMPLATE = 'horizon://knowledge/{topic}/{section}'; diff --git a/src/resources/knowledge/server_rules.md b/src/resources/knowledge/server_rules.md index c758477..c0675b0 100644 --- a/src/resources/knowledge/server_rules.md +++ b/src/resources/knowledge/server_rules.md @@ -46,10 +46,10 @@ often live only in the discovery metadata. ## 5. PKCS#12 / PFX retrieval The PKCS#12 bundle (certificate plus private key) is never on the certificate -object. It is only returned in the enrollment REQUEST response. When the user -asks for a PKCS#12, PFX, or private key: +object. It is returned in the enrollment or recover REQUEST response. When the +user asks for a PKCS#12, PFX, or private key: -1. Find the enrollment request via `search_requests`. +1. Find the enrollment or recover request via `search_requests`. 2. Call `get_request` to read it; the `pkcs12` / `keyStore` field contains the base64-encoded bundle. @@ -61,7 +61,8 @@ request. Before calling `submit_request`, call `get_request_template` to discover which fields are required, editable, computed, or fixed by the profile, then ask the user for any missing values. For `revoke`, `revocationReason` is -mandatory. For any workflow, optionally offer the user a free-text +strongly recommended; ask the user for it - Horizon defaults to `unspecified` +if omitted. For any workflow, optionally offer the user a free-text `requesterComment` justification. The outcome of `submit_request` depends on permissions: diff --git a/src/tools/assist/system.ts b/src/tools/assist/system.ts index 136c240..9561df0 100644 --- a/src/tools/assist/system.ts +++ b/src/tools/assist/system.ts @@ -18,13 +18,18 @@ export function registerSystemTools( 'For ownership queries combine the identifier and team list: ' + '`owner equals "" or team in ("", ...)`. ' + 'See horizon://knowledge/query-languages for ownership patterns.', + // Horizon serializes absent collections/values as `null` rather than + // omitting them (e.g. a principal in no teams gets `teams: null`). The + // raw response is piped straight into structuredContent, so every field + // must accept null (.nullish() = nullable + optional) or the MCP output + // validation rejects the whole whoami response before the client reads it. outputSchema: { - identifier: z.string().optional(), - name: z.string().optional(), - team: z.string().optional(), - teams: z.array(z.string()).optional(), - roles: z.array(z.unknown()).optional(), - permissions: z.unknown().optional(), + identifier: z.string().nullish(), + name: z.string().nullish(), + team: z.string().nullish(), + teams: z.array(z.string()).nullish(), + roles: z.array(z.unknown()).nullish(), + permissions: z.unknown().nullish(), }, }, async () => { @@ -44,23 +49,27 @@ export function registerSystemTools( { description: 'Return Horizon license info: modules, expiry, quotas, feature flags.', + // Raw license response is piped straight into structuredContent. Horizon + // may serialize absent fields as `null` (and the shape drifts across + // versions), so every field is .nullish() to keep output validation from + // rejecting an otherwise-valid response. outputSchema: { - isValid: z.boolean().optional(), - version: z.string().optional(), - expiration: z.number().optional(), - buildTime: z.number().optional(), - count: z.number().optional(), - dcvCount: z.number().optional(), + isValid: z.boolean().nullish(), + version: z.string().nullish(), + expiration: z.number().nullish(), + buildTime: z.number().nullish(), + count: z.number().nullish(), + dcvCount: z.number().nullish(), // Horizon 2.10 returns module entitlements as objects ({ module, items }); // older instances returned bare module-name strings. Accept either. modules: z .array(z.union([z.string(), z.record(z.string(), z.unknown())])) - .optional(), - libraries: z.array(z.record(z.string(), z.unknown())).optional(), - releaseChannel: z.string().optional(), + .nullish(), + libraries: z.array(z.record(z.string(), z.unknown())).nullish(), + releaseChannel: z.string().nullish(), // Legacy / forward-compatible fields kept permissive. - expiry: z.string().optional(), - features: z.record(z.string(), z.unknown()).optional(), + expiry: z.string().nullish(), + features: z.record(z.string(), z.unknown()).nullish(), }, }, async () => { diff --git a/src/tools/docs.ts b/src/tools/docs.ts index 3321713..28900ac 100644 --- a/src/tools/docs.ts +++ b/src/tools/docs.ts @@ -12,6 +12,11 @@ import { import { searchDocPages } from '../docs/search.js'; import type { DocPage, DocProduct } from '../docs/types.js'; import { resolveDocVersion } from '../docs/versioning.js'; +import { + getKnowledgeSectionSlugs, + getKnowledgeTopicSlugs, + resolveKnowledge, +} from '../resources/catalog.js'; import { registerTool } from './register.js'; const SEARCH_MAX_RESULTS = 10; @@ -80,6 +85,45 @@ function selectProductPages( return product ? pages.filter((page) => page.product === product) : pages; } +type ContentTruncation = + | { + truncated: true; + total_chars: number; + offset: number; + returned_chars: number; + next_offset: number; + } + | { truncated: false; total_chars: number }; + +/** + * Window long content by `maxChars` starting at `offset`, returning the slice + * plus a truncation notice with `next_offset` for continuation. Shared by + * get_doc_page and read_knowledge. + */ +function windowContent( + full: string, + offset: number, + maxChars: number, +): { content: string; truncation: ContentTruncation } { + const totalChars = full.length; + const content = full.slice(offset, offset + maxChars); + const endOffset = offset + content.length; + const truncated = endOffset < totalChars; + + return { + content, + truncation: truncated + ? { + truncated: true, + total_chars: totalChars, + offset, + returned_chars: content.length, + next_offset: endOffset, + } + : { truncated: false, total_chars: totalChars }, + }; +} + function buildDocPageContent(page: DocPage): string { const sections = [ page.method && page.api_path ? `${page.method} ${page.api_path}` : null, @@ -287,17 +331,35 @@ export function registerDocsTools( 'get_doc_page', { description: - 'Return the full indexed content of a specific documentation page.\n\n' + - 'Always call search_docs or search_api_docs first and pass one of their page_id values here. Do not guess or fabricate page IDs. If the page is not the one you need, go back to search and refine the query instead of guessing another page_id.', + 'Return the indexed content of a specific documentation page.\n\n' + + 'Always call search_docs or search_api_docs first and pass one of their page_id values here. Do not guess or fabricate page IDs. If the page is not the one you need, go back to search and refine the query instead of guessing another page_id.\n\n' + + 'Long pages are returned in windows bounded by max_chars. When the content exceeds the window the response carries a truncation notice with total_chars and next_offset; call the tool again with that offset to continue.', inputSchema: z.object({ page_id: z .string() .describe( 'Exact page_id returned by search_docs or search_api_docs.', ), + max_chars: z + .number() + .int() + .positive() + .max(50000) + .default(20000) + .describe( + 'Maximum number of content characters to return in this window (1-50000, default 20000).', + ), + offset: z + .number() + .int() + .min(0) + .default(0) + .describe( + 'Character offset into the page content to start from. Use next_offset from a prior truncated response to continue.', + ), }), }, - async ({ page_id }) => { + async ({ page_id, max_chars, offset }) => { const page = getDocPageById(page_id); if (!page) { return { @@ -312,6 +374,13 @@ export function registerDocsTools( }; } + const fullContent = buildDocPageContent(page); + const { content, truncation } = windowContent( + fullContent, + offset, + max_chars, + ); + return { content: [ { @@ -328,7 +397,96 @@ export function registerDocsTools( summary: page.summary, method: page.method, path: page.api_path, - content: buildDocPageContent(page), + content, + truncation, + }), + }, + ], + }; + }, + ); + + registerTool( + server, + 'read_knowledge', + { + description: + 'Return the embedded Horizon knowledge base content for a topic as tool output.\n\n' + + 'Use when: a horizon://knowledge/* resource is referenced but the client cannot read MCP resources. This exposes the same guidance (server rules, query languages, workflows, integration recipes, ...) through a tool call instead.\n\n' + + 'Pass a topic slug (the segment after horizon://knowledge/). Optionally pass a section slug to fetch a single section of a long topic. Call with no valid topic to get the list of valid topics in the error.\n\n' + + 'Long topics are returned in windows bounded by max_chars. When the content exceeds the window the response carries a truncation notice with total_chars and next_offset; call again with that offset to continue.', + inputSchema: z.object({ + topic: z + .string() + .describe( + 'Knowledge topic slug, e.g. server-rules, query-languages, tool-selection. This is the segment after horizon://knowledge/.', + ), + section: z + .string() + .optional() + .describe( + 'Optional section slug within the topic (only some topics are split into sections).', + ), + max_chars: z + .number() + .int() + .positive() + .max(50000) + .default(20000) + .describe( + 'Maximum number of content characters to return in this window (1-50000, default 20000).', + ), + offset: z + .number() + .int() + .min(0) + .default(0) + .describe( + 'Character offset into the content to start from. Use next_offset from a prior truncated response to continue.', + ), + }), + }, + async ({ topic, section, max_chars, offset }) => { + const resource = resolveKnowledge(topic, section); + if (!resource) { + const validTopics = getKnowledgeTopicSlugs(); + const error = section + ? `Unknown section '${section}' for topic '${topic}'.` + : `Unknown knowledge topic '${topic}'.`; + const sections = getKnowledgeSectionSlugs(topic); + return { + content: [ + { + type: 'text' as const, + text: JSON.stringify({ + error, + valid_topics: validTopics, + ...(section && sections.length > 0 + ? { valid_sections: sections } + : {}), + }), + }, + ], + }; + } + + const { content, truncation } = windowContent( + resource.content, + offset, + max_chars, + ); + + return { + content: [ + { + type: 'text' as const, + text: JSON.stringify({ + topic, + section: section ?? null, + uri: resource.uri, + description: resource.description, + content, + truncation, }), }, ], diff --git a/src/tools/helpers.ts b/src/tools/helpers.ts index d4c9e6b..022c258 100644 --- a/src/tools/helpers.ts +++ b/src/tools/helpers.ts @@ -416,7 +416,6 @@ export function buildExportPayload( query, pageIndex: toApiPageIndex(0), pageSize: MAX_CSV_ROWS, - withCount: true, }; if (fields && fields.length > 0) payload['fields'] = fields; const sorted = buildSortedBy(sortedBy); diff --git a/src/tools/lifecycle/certificates.ts b/src/tools/lifecycle/certificates.ts index e926356..6602276 100644 --- a/src/tools/lifecycle/certificates.ts +++ b/src/tools/lifecycle/certificates.ts @@ -147,14 +147,22 @@ export function registerCertificateTools( { description: 'Export certificates matching an HCQL query as CSV (max 1000 rows; ' + - 'use Horizon UI for full exports). Lowercase fields only. ' + + 'use Horizon UI for full exports). HCQL query fields are lowercase; the ' + + 'CSV `fields` columns are camelCase (see the fields param). ' + 'Full reference: horizon://knowledge/query-languages.', inputSchema: z.object({ query: z.string().describe('HCQL query expression.'), fields: z .array(z.string()) .optional() - .describe('Fields to include in the CSV export.'), + .describe( + 'CSV columns to include, as camelCase API column names (SearchResult ' + + 'columns) - NOT the lowercase HCQL query fields. Examples: dn, ' + + 'serial, contactEmail, autoRenew, module, profile, notAfter. Prefix ' + + 'families: label., metadata., grade., ' + + 'team.displayname.. Invalid names return a Horizon 500 that ' + + 'lists the usable columns.', + ), sorted_by: z .string() .optional() @@ -194,34 +202,17 @@ export function registerCertificateTools( description: 'Download a certificate as PEM. Returned as an embedded resource ' + '(application/x-pem-file). The PKCS#12 bundle is not on the certificate ' + - 'object; for centralized enrollments retrieve it via search_requests + ' + - 'get_request (pkcs12 / keyStore field).', + 'object; for centralized enrollment or recover requests retrieve it via ' + + 'search_requests + get_request (pkcs12 / keyStore field).', inputSchema: z.object({ certificate_id: z.string().describe('Certificate ID.'), format: z - .string() + .enum(['pem']) .default('pem') .describe("Output format (only 'pem' is supported via the API)."), }), }, - async ({ certificate_id, format }) => { - const fmt = format.toLowerCase(); - if (fmt !== 'pem') { - return { - isError: true as const, - content: [ - { - type: 'text' as const, - text: JSON.stringify({ - error: - `Only PEM format is available via the API. ` + - `For ${fmt.toUpperCase()} format, use the Horizon UI.`, - }), - }, - ], - }; - } - + async ({ certificate_id }) => { const cert = await client.get>( `/api/v1/certificates/${encodePathSegment(certificate_id)}`, ); diff --git a/src/tools/lifecycle/events.ts b/src/tools/lifecycle/events.ts index 28a8122..d01efae 100644 --- a/src/tools/lifecycle/events.ts +++ b/src/tools/lifecycle/events.ts @@ -127,14 +127,21 @@ export function registerEventTools( 'Export audit events matching an HEQL query as CSV (max 1000 rows via ' + 'paged search; use Horizon UI for full raw exports). Default columns: ' + '_id, code, module, node, timestamp, status; pass fields for detail.* ' + - 'columns. Lowercase fields only. ' + + 'columns. HEQL query fields are lowercase; the CSV `fields` columns are ' + + 'camelCase (see the fields param). ' + 'Full reference: horizon://knowledge/query-languages.', inputSchema: z.object({ query: z.string().describe('HEQL query expression.'), fields: z .array(z.string()) .optional() - .describe('Fields to include in the CSV export.'), + .describe( + 'CSV columns to include, as camelCase API column names (SearchResult ' + + 'columns) - NOT the lowercase HEQL query fields. Examples: code, ' + + 'module, timestamp, status, plus detail. for detail columns ' + + '(detail.actorId, detail.ip). Invalid names return a Horizon 500 ' + + 'that lists the usable columns.', + ), sorted_by: z .string() .optional() diff --git a/src/tools/lifecycle/requests.ts b/src/tools/lifecycle/requests.ts index 2648711..5783309 100644 --- a/src/tools/lifecycle/requests.ts +++ b/src/tools/lifecycle/requests.ts @@ -102,12 +102,18 @@ export function registerRequestTools( 'direct action permission (enrollApi, revokeApi, renewApi) the operation ' + 'completes immediately; with only the request permission the request is ' + 'created in PENDING state and needs approve_request. Surface that status ' + - 'to the user. For revoke, revocationReason is mandatory (keycompromise, ' + - 'cacompromise, affiliationchange, superseded, cessationofoperation, ' + - 'certificatehold, removefromcrl, privilegewithdrawn, aacompromise, ' + - 'unspecified). Modules: webra, est, scep, acme, crmp, wcce, intune, jamf. ' + + 'to the user. This can perform destructive workflows (revoke); confirm ' + + 'with the user before submitting a revoke. For revoke, revocationReason is ' + + 'strongly recommended - ask the user for it; Horizon defaults to ' + + "'unspecified' if omitted (keycompromise, cacompromise, affiliationchange, " + + 'superseded, cessationofoperation, certificatehold, removefromcrl, ' + + 'privilegewithdrawn, aacompromise, unspecified). ' + + 'Modules: webra, est, scep, acme, crmp, wcce, intune, jamf. ' + 'EST/SCEP enroll returns the challenge password in the response. ' + 'Full workflow + examples: horizon://knowledge/workflows.', + // submit_request can run revoke workflows, so mark it destructive even + // though the name-prefix classifier treats it as an additive mutation. + annotations: { destructiveHint: true }, inputSchema: z.object({ workflow: z .string() @@ -474,14 +480,21 @@ export function registerRequestTools( { description: 'Export requests matching an HRQL query as CSV (max 1000 rows; use Horizon ' + - 'UI for full exports). Lowercase fields only (registration.date, not ' + - 'registrationDate). Full reference: horizon://knowledge/query-languages.', + 'UI for full exports). HRQL query fields are lowercase (registration.date, ' + + 'not registrationDate); the CSV `fields` columns are camelCase (see the ' + + 'fields param). Full reference: horizon://knowledge/query-languages.', inputSchema: z.object({ query: z.string().describe('HRQL query expression.'), fields: z .array(z.string()) .optional() - .describe('Fields to include in the CSV export.'), + .describe( + 'CSV columns to include, as camelCase API column names (SearchResult ' + + 'columns) - NOT the lowercase HRQL query fields. Examples: profile, ' + + 'requestType, status, contactEmail, registrationDate. Prefix ' + + 'families: label., metadata.. Invalid names return a ' + + 'Horizon 500 that lists the usable columns.', + ), sorted_by: z .string() .optional() diff --git a/src/tools/register.ts b/src/tools/register.ts index e9f8f36..d5cf151 100644 --- a/src/tools/register.ts +++ b/src/tools/register.ts @@ -20,19 +20,12 @@ import { buildToolDescription } from './guidance.js'; type ToolExtra = RequestHandlerExtra; -export type TaskSupport = 'forbidden' | 'optional' | 'required'; - -export interface ToolExecution { - readonly taskSupport: TaskSupport; -} - type ToolConfigBase = { title?: string; description?: string; inputSchema?: unknown; outputSchema?: unknown; annotations?: ToolAnnotations; - execution?: ToolExecution; _meta?: Record; }; @@ -73,7 +66,6 @@ export interface RegisterToolOptions { interface Classification { readonly annotations: ToolAnnotations; readonly title: string; - readonly taskSupport?: TaskSupport; } const TITLE_OVERRIDES: Record = { @@ -113,16 +105,6 @@ function titleFromName(name: string): string { .join(' '); } -const TASK_OPTIONAL_TOOLS: ReadonlySet = new Set([ - 'export_certificates_csv', - 'export_requests_csv', - 'export_events_csv', - 'download_certificate', - 'download_report', - 'generate_report', - 'launch_discovery_campaign', -]); - function classify(name: string): Classification { const title = titleFromName(name); @@ -135,7 +117,7 @@ function classify(name: string): Classification { // Read-only families if ( - /^(search|list|get|aggregate|describe|validate|simulate|decode|export|download|explain|test)_/.test( + /^(search|list|get|read|aggregate|describe|validate|simulate|decode|export|download|explain|test)_/.test( name, ) || name === 'whoami' || @@ -155,7 +137,6 @@ function classify(name: string): Classification { return { annotations: ann, title, - taskSupport: TASK_OPTIONAL_TOOLS.has(name) ? 'optional' : undefined, }; } @@ -200,7 +181,6 @@ function classify(name: string): Classification { openWorldHint: true, }, title, - taskSupport: TASK_OPTIONAL_TOOLS.has(name) ? 'optional' : undefined, }; } @@ -238,6 +218,28 @@ function wrapHandler( }; } +// --------------------------------------------------------------------------- +// Per-server registration config (read-only gating) +// --------------------------------------------------------------------------- +// +// Keyed on the McpServer instance rather than a module global so each session +// server (HTTP builds one per session) carries its own config with no +// cross-session leakage. `configureToolRegistration` is called once by the +// server factory before any tool is registered. + +interface ToolRegistrationConfig { + readonly readOnly: boolean; +} + +const registrationConfig = new WeakMap(); + +export function configureToolRegistration( + server: McpServer, + config: ToolRegistrationConfig, +): void { + registrationConfig.set(server, config); +} + // --------------------------------------------------------------------------- // Public API // --------------------------------------------------------------------------- @@ -249,8 +251,6 @@ function wrapHandler( * - `annotations` defaults (readOnlyHint, destructiveHint, idempotentHint, * openWorldHint, title) derived from the tool name. Explicit * `config.annotations` overrides win. - * - `execution.taskSupport: 'optional'` on long-running tools (CSV exports, - * downloads, report generation, discovery campaign launches). * - Compact `[when: ... | not: ... | pre: ...]` guidance suffix when * `guidance.ts` has an explicit entry for the tool. * - `HorizonError` -> `{ isError: true, structuredContent: { ... } }` so the @@ -294,11 +294,16 @@ export function registerTool( ...config.annotations, }; const title = config.title ?? classification.title; - const execution: ToolExecution | undefined = - config.execution ?? - (classification.taskSupport - ? { taskSupport: classification.taskSupport } - : undefined); + + // Read-only mode: skip registering any tool whose effective annotations do + // not mark it read-only. The caller ignores the return value, so returning + // undefined here is safe. + if ( + registrationConfig.get(server)?.readOnly && + annotations.readOnlyHint !== true + ) { + return undefined as unknown as ReturnType; + } const handler = wrapErrors ? wrapHandler(cb as (...args: unknown[]) => ToolResult) @@ -314,7 +319,6 @@ export function registerTool( ? undefined : (config.inputSchema as unknown as AnySchema | ZodRawShapeCompat), }; - if (execution !== undefined) sdkConfig['execution'] = execution; return server.registerTool( name, diff --git a/tests/unit/__snapshots__/golden.test.ts.snap b/tests/unit/__snapshots__/golden.test.ts.snap index d9fc83e..a82c368 100644 --- a/tests/unit/__snapshots__/golden.test.ts.snap +++ b/tests/unit/__snapshots__/golden.test.ts.snap @@ -894,6 +894,9 @@ exports[`Golden tests > tool schemas match snapshot 1`] = ` }, "format": { "default": "pem", + "enum": [ + "pem", + ], "type": "string", }, }, @@ -1266,6 +1269,14 @@ exports[`Golden tests > tool schemas match snapshot 1`] = ` "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { + "max_chars": { + "default": 20000, + "type": "number", + }, + "offset": { + "default": 0, + "type": "number", + }, "page_id": { "type": "string", }, @@ -1544,6 +1555,32 @@ exports[`Golden tests > tool schemas match snapshot 1`] = ` }, "name": "list_triggers", }, + { + "inputSchema": { + "$schema": "http://json-schema.org/draft-07/schema#", + "properties": { + "max_chars": { + "default": 20000, + "type": "number", + }, + "offset": { + "default": 0, + "type": "number", + }, + "section": { + "type": "string", + }, + "topic": { + "type": "string", + }, + }, + "required": [ + "topic", + ], + "type": "object", + }, + "name": "read_knowledge", + }, { "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", diff --git a/tests/unit/docs.test.ts b/tests/unit/docs.test.ts index dcd45de..3b40ffa 100644 --- a/tests/unit/docs.test.ts +++ b/tests/unit/docs.test.ts @@ -220,4 +220,95 @@ describe('Documentation tools', () => { expect(result['content']).toContain('GET /api/v1/requests/{id}'); expect(result['content']).toContain('Retrieve a request'); }); + + it('get_doc_page truncates long content and reports next_offset', async () => { + const client = await createDocsToolClient(createMockClient()); + + const result = await callJsonTool(client, 'get_doc_page', { + page_id: 'horizon-api:2.8:api-ref:request_get', + max_chars: 10, + }); + + const content = result['content'] as string; + expect(content.length).toBe(10); + const truncation = result['truncation'] as Record; + expect(truncation['truncated']).toBe(true); + expect(truncation['offset']).toBe(0); + expect(truncation['returned_chars']).toBe(10); + expect(truncation['next_offset']).toBe(10); + expect(truncation['total_chars']).toBeGreaterThan(10); + }); + + it('get_doc_page continues from a supplied offset and marks the final window', async () => { + const client = await createDocsToolClient(createMockClient()); + + // First window reveals the total length via the truncation notice. + const head = await callJsonTool(client, 'get_doc_page', { + page_id: 'horizon-api:2.8:api-ref:request_get', + max_chars: 20, + }); + const headTrunc = head['truncation'] as Record; + expect(headTrunc['truncated']).toBe(true); + const total = headTrunc['total_chars'] as number; + + // A window starting near the end returns only the remaining chars and is + // marked as the final (non-truncated) window. + const tail = await callJsonTool(client, 'get_doc_page', { + page_id: 'horizon-api:2.8:api-ref:request_get', + max_chars: 50000, + offset: total - 5, + }); + const tailContent = tail['content'] as string; + expect(tailContent.length).toBe(5); + const tailTrunc = tail['truncation'] as Record; + expect(tailTrunc['truncated']).toBe(false); + expect(tailTrunc['total_chars']).toBe(total); + }); +}); + +describe('read_knowledge tool', () => { + it('returns the embedded content for a valid topic', async () => { + const client = await createDocsToolClient(createMockClient()); + + const result = await callJsonTool(client, 'read_knowledge', { + topic: 'server-rules', + }); + + expect(result['topic']).toBe('server-rules'); + expect(result['uri']).toBe('horizon://knowledge/server-rules'); + expect((result['content'] as string).length).toBeGreaterThan(0); + const truncation = result['truncation'] as Record; + expect(truncation['total_chars']).toBeGreaterThan(0); + }); + + it('errors with the valid topic list for an unknown topic', async () => { + const client = await createDocsToolClient(createMockClient()); + + const result = await callJsonTool(client, 'read_knowledge', { + topic: 'not-a-real-topic', + }); + + expect(result['error']).toContain('not-a-real-topic'); + const topics = result['valid_topics'] as string[]; + expect(topics).toContain('server-rules'); + expect(topics).toContain('query-languages'); + }); + + it('truncates long content and reports next_offset', async () => { + const client = await createDocsToolClient(createMockClient()); + + const result = await callJsonTool(client, 'read_knowledge', { + topic: 'server-rules', + max_chars: 10, + }); + + const content = result['content'] as string; + expect(content.length).toBe(10); + const truncation = result['truncation'] as Record; + expect(truncation['truncated']).toBe(true); + expect(truncation['offset']).toBe(0); + expect(truncation['returned_chars']).toBe(10); + expect(truncation['next_offset']).toBe(10); + expect(truncation['total_chars']).toBeGreaterThan(10); + }); }); diff --git a/tests/unit/golden.test.ts b/tests/unit/golden.test.ts index 3349d96..4333578 100644 --- a/tests/unit/golden.test.ts +++ b/tests/unit/golden.test.ts @@ -92,10 +92,11 @@ const EXPECTED_TOOL_NAMES: string[] = [ 'get_license_info', 'explain_grading_policy', 'explain_grading_ruleset', - // docs.ts (3) + // docs.ts (4) 'search_docs', 'search_api_docs', 'get_doc_page', + 'read_knowledge', // assist/computation.ts (2) 'simulate_computation_rule', 'simulate_datasource_flow', @@ -262,9 +263,9 @@ describe('Golden tests', () => { // Tool count and enumeration // ----------------------------------------------------------------- - it('registers exactly 85 tools', async () => { + it('registers exactly 86 tools', async () => { const result = await client.listTools(); - expect(result.tools.length).toBe(85); + expect(result.tools.length).toBe(86); }); it('tool name enumeration matches expected set exactly', async () => { @@ -331,6 +332,14 @@ describe('Golden tests', () => { } }); + it('submit_request is marked destructive (it can run revoke workflows)', async () => { + const result = await client.listTools(); + const submit = result.tools.find((t) => t.name === 'submit_request'); + expect(submit, 'submit_request tool missing').toBeTruthy(); + expect(submit!.annotations?.destructiveHint).toBe(true); + expect(submit!.annotations?.readOnlyHint).toBe(false); + }); + it('tools with explicit guidance use the compact [when: ...] format', async () => { const result = await client.listTools(); for (const tool of result.tools) { @@ -969,8 +978,8 @@ describe('Tool registration verification', () => { toolNames = new Set(result.tools.map((t) => t.name)); }); - it('registers exactly 85 tools', () => { - expect(toolNames.size).toBe(85); + it('registers exactly 86 tools', () => { + expect(toolNames.size).toBe(86); }); it('excludes admin tools', () => { diff --git a/tests/unit/helpers.test.ts b/tests/unit/helpers.test.ts index cda0963..b292e5d 100644 --- a/tests/unit/helpers.test.ts +++ b/tests/unit/helpers.test.ts @@ -424,13 +424,13 @@ describe('buildSearchResponse', () => { }); describe('buildExportPayload', () => { - it('builds bounded export payload with row cap and count request', () => { + it('builds bounded export payload with row cap and no count request', () => { const payload = buildExportPayload('*'); expect(payload.query).toBe('*'); expect(payload.pageIndex).toBe(1); expect(payload.pageSize).toBe(1000); - expect(payload.withCount).toBe(true); + expect(payload).not.toHaveProperty('withCount'); expect(payload).not.toHaveProperty('fields'); expect(payload).not.toHaveProperty('sortedBy'); }); @@ -617,18 +617,14 @@ describe('download_certificate failure branches surface isError', () => { ]); }); - it('flags an unsupported format as an error result', async () => { + it('rejects an unsupported format at the schema level', async () => { const result = (await client.callTool({ name: 'download_certificate', arguments: { certificate_id: 'abc-123', format: 'der' }, })) as { isError?: boolean; content: Array<{ text: string }> }; expect(result.isError).toBe(true); - const parsed = JSON.parse(result.content[0]!.text) as Record< - string, - unknown - >; - expect(String(parsed['error'])).toContain('Only PEM'); + expect(result.content[0]!.text).toContain('format'); }); it('flags a missing PEM as an error result', async () => { diff --git a/tests/unit/tool-dispatch.test.ts b/tests/unit/tool-dispatch.test.ts new file mode 100644 index 0000000..2041bdc --- /dev/null +++ b/tests/unit/tool-dispatch.test.ts @@ -0,0 +1,67 @@ +/** + * SDK-dispatch regression tests. + * + * Unit tests elsewhere invoke tool handlers directly, bypassing the MCP + * SDK's `registerTool` path. This suite drives a representative tool through + * the real McpServer + InMemoryTransport client so that whatever config keys + * `registerTool` forwards to the SDK are actually accepted. It locks in that + * the handler executes and the call does not fail with the SDK's + * `taskSupport` registration error (the SDK hardcodes + * `execution.taskSupport: 'forbidden'` and drops any injected `execution`). + */ +import { Client } from '@modelcontextprotocol/sdk/client/index.js'; +import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'; +import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; +import { describe, expect, it } from 'vitest'; + +import type { HorizonClient } from '../../src/client/http.js'; +import { registerCertificateTools } from '../../src/tools/lifecycle/certificates.js'; + +function createMockClient(): HorizonClient { + return { + async postText(): Promise { + return 'dn,serial\nCN=a,01\n'; + }, + } as unknown as HorizonClient; +} + +async function createCertToolClient(): Promise { + const server = new McpServer({ name: 'dispatch-test', version: '0.0.0' }); + registerCertificateTools(server, createMockClient()); + + const [clientTransport, serverTransport] = + InMemoryTransport.createLinkedPair(); + const client = new Client({ + name: 'dispatch-test-client', + version: '0.0.0', + }); + await Promise.all([ + client.connect(clientTransport), + server.connect(serverTransport), + ]); + return client; +} + +describe('SDK tool dispatch', () => { + it('executes export_certificates_csv through the real SDK without a taskSupport error', async () => { + const client = await createCertToolClient(); + + const result = await client.callTool({ + name: 'export_certificates_csv', + arguments: { query: 'dn contains "example"' }, + }); + + const text = ( + result.content as Array<{ type: string; text?: string }> + ).find((item) => item.type === 'text')?.text; + + expect(result.isError).toBeFalsy(); + expect(text).toBeDefined(); + expect(text).not.toContain('taskSupport'); + + const payload = JSON.parse(text!) as Record; + expect(payload['csv']).toBe('dn,serial\nCN=a,01\n'); + + await client.close(); + }); +}); diff --git a/tests/unit/tools.test.ts b/tests/unit/tools.test.ts index e5a940a..5d02467 100644 --- a/tests/unit/tools.test.ts +++ b/tests/unit/tools.test.ts @@ -504,37 +504,34 @@ describe('Lifecycle tools', () => { expect(parsed['content']).toBe(pem); }); - it('rejects non-PEM format', async () => { - const result = await client.callTool({ + it('rejects non-PEM format at the schema level', async () => { + const result = (await client.callTool({ name: 'download_certificate', arguments: { certificate_id: 'abc-123', format: 'der' }, - }); - const parsed = parseToolResult(result); + })) as { isError?: boolean; content: Array<{ text: string }> }; - expect(parsed['error']).toBeDefined(); - expect(String(parsed['error'])).toContain('Only PEM'); + expect(result.isError).toBe(true); + expect(result.content[0]!.text).toContain('format'); }); - it('rejects invalid format', async () => { - const result = await client.callTool({ + it('rejects invalid format at the schema level', async () => { + const result = (await client.callTool({ name: 'download_certificate', arguments: { certificate_id: 'abc-123', format: 'xml' }, - }); - const parsed = parseToolResult(result); + })) as { isError?: boolean; content: Array<{ text: string }> }; - expect(parsed['error']).toBeDefined(); - expect(String(parsed['error'])).toContain('Only PEM'); + expect(result.isError).toBe(true); + expect(result.content[0]!.text).toContain('format'); }); - it('rejects JKS format', async () => { - const result = await client.callTool({ + it('rejects JKS format at the schema level', async () => { + const result = (await client.callTool({ name: 'download_certificate', arguments: { certificate_id: 'abc-123', format: 'jks' }, - }); - const parsed = parseToolResult(result); + })) as { isError?: boolean; content: Array<{ text: string }> }; - expect(parsed['error']).toBeDefined(); - expect(String(parsed['error'])).toContain('Only PEM'); + expect(result.isError).toBe(true); + expect(result.content[0]!.text).toContain('format'); }); }); @@ -986,6 +983,31 @@ describe('Assist tools', () => { expect(parsed['identifier']).toBe('test-admin'); expect(parsed['roles']).toEqual(['admin']); }); + + it('tolerates null collection fields (principal in no teams / no roles)', async () => { + // Horizon serializes absent collections as `null`, not `[]` or omitted. + // The output schema must accept null or the MCP stack rejects the whole + // whoami response before the client can read it. + const principal = { + identifier: 'svc-account', + name: 'Service Account', + team: null, + teams: null, + roles: null, + permissions: null, + }; + mockClient.get.mockResolvedValueOnce(principal); + + const result = await client.callTool({ + name: 'whoami', + arguments: {}, + }); + + expect((result as { isError?: boolean }).isError).toBeFalsy(); + const parsed = parseToolResult(result); + expect(parsed['identifier']).toBe('svc-account'); + expect(parsed['teams']).toBeNull(); + }); }); describe('decode_x509', () => { From 01baed013860b9a43557cff20ea3bbf90ea4ef1a Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 2 Jul 2026 12:30:14 +0200 Subject: [PATCH 06/12] feat: add toolset gating (HORIZON_ENABLED_TOOLSETS, HORIZON_READ_ONLY) and read_knowledge tool --- README.md | 4 +- src/index.ts | 10 ++- src/server-factory.ts | 121 ++++++++++++++++++++++++------ src/settings.ts | 24 ++++++ tests/unit/server-factory.test.ts | 75 +++++++++++++++++- tests/unit/settings.test.ts | 32 ++++++++ 6 files changed, 239 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index 422441a..9d76c7c 100644 --- a/README.md +++ b/README.md @@ -109,6 +109,8 @@ The server auto-detects the authentication mode based on which variables are set | `HORIZON_LOG_LEVEL` | No | `INFO` | One of `DEBUG`, `INFO`, `WARNING`, `ERROR`. | | `HORIZON_TESTED_VERSIONS` | No | `2.8` | Comma-separated list of Horizon versions known to fully work with this build. | | `HORIZON_WARN_VERSIONS` | No | `2.7,2.9` | Comma-separated list of versions that are likely to work but emit a warning. | +| `HORIZON_ENABLED_TOOLSETS` | No | (all) | Comma-separated list of tool domains to register, trimming the context cost of the full tool set. Valid names: `lifecycle`, `profiles`, `dashboards`, `discovery`, `datasources`, `reports`, `triggers`, `docs`, `assist`, `config`. Unset registers every toolset; an unknown name fails startup. | +| `HORIZON_READ_ONLY` | No | `false` | Set to `true` or `1` to register only read-only tools; every mutating tool (create/update/delete/submit/...) is skipped at startup. | | `HORIZON_AUTH_MODE` | DEPRECATED | | No longer required. Kept readable for backward compatibility; setting it logs a warning. | ### Streamable HTTP (`HORIZON_TRANSPORT=http`) @@ -227,7 +229,7 @@ The MCP supports exactly two credential types against Horizon: a **Horizon API k In stdio mode the credential comes from the environment. In streamable HTTP mode, `HORIZON_HTTP_AUTH_MODE` selects how each caller's identity is established: - **`service`** - the MCP holds one env credential (an API key or mTLS to Horizon) and acts as a single identity for every caller; clients send only the URL. The anti-hijack session fingerprint does not apply in this mode (`Mcp-Session-Id` behaves as a bearer), so the front door must be access-controlled by network placement or an authenticating edge; use a least-privileged identity. -- **`api-key`** (per-caller) - the client sends its own `X-API-ID` / `X-API-KEY`, which the MCP forwards to Horizon. This forwards a long-lived secret through the MCP. +- **`api-key`** (per-caller) - the client sends its own `X-API-ID` / `X-API-KEY`, which the MCP forwards to Horizon. This forwards a long-lived secret through the MCP, so on a non-loopback bind the endpoint must terminate TLS (set `HORIZON_PUBLIC_URL` to an `https` origin behind a TLS-terminating proxy); a cleartext `http` endpoint on a non-loopback host refuses to start. - **`mtls`** (per-caller, terminate-and-forward) - the client presents a TLS client certificate; the MCP (or a trusted ingress) terminates the TLS with `optional_no_ca` semantics (proving possession, not validating the chain) and forwards the certificate to Horizon's Play backend in `HORIZON_FORWARD_CERT_HEADER`. Horizon validates the chain, revocation, and identity. No long-lived secret is forwarded. Most MCP clients cannot present a client certificate, so a local mTLS proxy on the client side is usually needed (see [docs/client-setup.md](docs/client-setup.md)). > [!IMPORTANT] diff --git a/src/index.ts b/src/index.ts index bca7b2c..857d80f 100644 --- a/src/index.ts +++ b/src/index.ts @@ -6,7 +6,7 @@ import { HorizonClient } from './client/http.js'; import { buildHttpConfig } from './http/config.js'; import { startHttpServer } from './http/server.js'; import { configureLogging, getLogger, setMcpLoggingSink } from './logging.js'; -import { createSessionServer } from './server-factory.js'; +import { assertToolsetsValid, createSessionServer } from './server-factory.js'; import { type HorizonSettings, loadSettings } from './settings.js'; const logger = getLogger('horizon_mcp.server'); @@ -38,7 +38,10 @@ async function runStdio(settings: HorizonSettings): Promise { warnVersions: settings.warnVersions, }); - const server = createSessionServer(client); + const server = createSessionServer(client, { + enabledToolsets: settings.enabledToolsets, + readOnly: settings.readOnly, + }); logger.info( 'Horizon MCP server ready (stdio) - auth will trigger on first tool call.', @@ -94,6 +97,9 @@ async function main(): Promise { const settings = loadSettings(); configureLogging(settings.logLevel); + // Fail-closed on a misconfigured toolset list before binding any transport. + assertToolsetsValid(settings.enabledToolsets); + if (settings.transport === 'http') { await runHttp(settings); } else { diff --git a/src/server-factory.ts b/src/server-factory.ts index 3a7dab8..828d16f 100644 --- a/src/server-factory.ts +++ b/src/server-factory.ts @@ -17,6 +17,7 @@ import { registerDiscoveryTools } from './tools/discovery.js'; import { registerDocsTools } from './tools/docs.js'; import { registerLifecycleTools } from './tools/lifecycle.js'; import { registerProfileTools } from './tools/profiles.js'; +import { configureToolRegistration } from './tools/register.js'; import { registerReportTools } from './tools/reports.js'; import { registerTriggerTools } from './tools/triggers.js'; @@ -33,8 +34,8 @@ export const SERVER_INSTRUCTIONS = [ '- Ownership queries: call `whoami` first; then', ' `owner equals "" or team in (...)`.', '- Lifecycle: call `get_request_template` before `submit_request`.', - ' `revocationReason` is mandatory for revoke.', - '- PKCS#12 lives on the enrollment request response only, never on the', + " `revocationReason` is strongly recommended for revoke; ask the user (Horizon defaults to 'unspecified').", + '- PKCS#12 lives on the enrollment or recover request response, never on the', ' certificate object.', '', 'Where to look:', @@ -43,13 +44,97 @@ export const SERVER_INSTRUCTIONS = [ '- Picking the right tool: horizon://knowledge/tool-selection', ].join('\n'); +type ToolsetRegistrar = (server: McpServer, client: HorizonClient) => void; + +/** + * Registry of tool domains keyed by a stable toolset name. `HORIZON_ENABLED_TOOLSETS` + * selects a subset of these; the object insertion order is also the registration + * order. Grouping mirrors the `src/tools/` file layout: + * + * - `lifecycle` certificate/request/event lifecycle tools + * - `profiles` profile listing/inspection + * - `dashboards` dashboards and saved queries + * - `discovery` discovery campaigns, events, and feed sessions + * - `datasources` datasource CRUD and simulation + * - `reports` report generation + * - `triggers` trigger/automation tools + * - `docs` product/API doc search, fetch, and read_knowledge + * - `assist` whoami/license/HQL/crypto/computation/translate helpers + * - `config` Horizon configuration-object CRUD (CAs, roles, teams, ...) + */ +const TOOLSET_REGISTRY: Record = { + lifecycle: registerLifecycleTools, + profiles: registerProfileTools, + dashboards: registerDashboardTools, + discovery: (server, client) => { + registerDiscoveryTools(server, client); + registerDiscoveryEventTools(server, client); + registerDiscoveryFeedTools(server, client); + }, + datasources: registerDatasourceTools, + reports: registerReportTools, + triggers: registerTriggerTools, + docs: registerDocsTools, + assist: (server, client) => { + registerSystemTools(server, client); + registerQueryTools(server, client); + registerCryptoTools(server, client); + registerComputationTools(server, client); + registerTranslateTools(server, client); + }, + config: registerConfigTools, +}; + +/** All registered toolset names, in registration order. */ +export const TOOLSET_NAMES = Object.keys(TOOLSET_REGISTRY); + +export interface SessionServerOptions { + /** + * Toolset names to register (see `TOOLSET_REGISTRY`). Undefined registers + * every toolset. Unknown names throw at startup with the valid list. + */ + readonly enabledToolsets?: readonly string[]; + /** When true, only read-only tools are registered (mutating tools skipped). */ + readonly readOnly?: boolean; +} + +/** + * Throw with the valid list if any requested toolset name is unknown. Called at + * startup so a misconfigured `HORIZON_ENABLED_TOOLSETS` refuses to start (in HTTP + * mode session servers are built per request, so per-session validation would be + * too late). + */ +export function assertToolsetsValid(enabled?: readonly string[]): void { + if (enabled === undefined) return; + + const unknown = enabled.filter((name) => !(name in TOOLSET_REGISTRY)); + if (unknown.length > 0) { + throw new Error( + `Unknown toolset(s) in HORIZON_ENABLED_TOOLSETS: ${unknown.join(', ')}. ` + + `Valid toolsets: ${TOOLSET_NAMES.join(', ')}.`, + ); + } +} + +function resolveToolsets(enabled?: readonly string[]): string[] { + assertToolsetsValid(enabled); + if (enabled === undefined) return TOOLSET_NAMES; + + // Register in registry order regardless of the order supplied. + const requested = new Set(enabled); + return TOOLSET_NAMES.filter((name) => requested.has(name)); +} + /** * Build a fully-wired McpServer bound to a single HorizonClient: knowledge - * resources plus every tool domain. Transport-agnostic - stdio builds one at - * startup, HTTP builds one per session so each session's tools close over that - * session's client (no shared client state across sessions). + * resources plus the selected tool domains. Transport-agnostic - stdio builds + * one at startup, HTTP builds one per session so each session's tools close over + * that session's client (no shared client state across sessions). */ -export function createSessionServer(client: HorizonClient): McpServer { +export function createSessionServer( + client: HorizonClient, + options: SessionServerOptions = {}, +): McpServer { const server = new McpServer( { name: 'Horizon MCP Server', version: pkg.version }, { @@ -62,26 +147,16 @@ export function createSessionServer(client: HorizonClient): McpServer { }, ); + // Wire read-only gating before any tool is registered. + configureToolRegistration(server, { readOnly: options.readOnly ?? false }); + // Knowledge resources first (mirrors prior startup order). registerAllResources(server); - // Tools by domain. - registerProfileTools(server, client); - registerLifecycleTools(server, client); - registerDashboardTools(server, client); - registerDiscoveryTools(server, client); - registerDiscoveryEventTools(server, client); - registerDiscoveryFeedTools(server, client); - registerDatasourceTools(server, client); - registerReportTools(server, client); - registerTriggerTools(server, client); - registerDocsTools(server, client); - registerSystemTools(server, client); - registerQueryTools(server, client); - registerCryptoTools(server, client); - registerComputationTools(server, client); - registerTranslateTools(server, client); - registerConfigTools(server, client); + // Tools by domain, filtered by the selected toolsets. + for (const name of resolveToolsets(options.enabledToolsets)) { + TOOLSET_REGISTRY[name]!(server, client); + } return server; } diff --git a/src/settings.ts b/src/settings.ts index f8c51b4..0c948b6 100644 --- a/src/settings.ts +++ b/src/settings.ts @@ -26,6 +26,20 @@ const csvListSchema = z .filter((s) => s.length > 0), ); +// Optional comma list: undefined when the env var is absent (or empties out), +// otherwise a trimmed non-empty string array. Undefined means "no filter". +const optionalCsvListSchema = z + .string() + .optional() + .transform((v) => { + if (v === undefined) return undefined; + const items = v + .split(',') + .map((s) => s.trim()) + .filter((s) => s.length > 0); + return items.length > 0 ? items : undefined; + }); + const settingsSchema = z.object({ url: z.string().default('https://localhost'), apiId: z.string().default(''), @@ -46,6 +60,16 @@ const settingsSchema = z.object({ testedVersions: z.array(z.string()).default(['2.8']), warnVersions: z.array(z.string()).default(['2.7', '2.9']), + // -- Toolset gating ----------------------------------------------------- + // `enabledToolsets` (HORIZON_ENABLED_TOOLSETS) selects which tool domains to + // register; undefined means all. `readOnly` (HORIZON_READ_ONLY) drops every + // mutating tool at registration time when enabled. + enabledToolsets: optionalCsvListSchema, + readOnly: z + .string() + .default('false') + .transform((v) => v.toLowerCase() === 'true' || v === '1'), + // -- Streamable HTTP transport ------------------------------------------ // All HTTP-mode settings. `transport` selects stdio (default) vs http. // Cross-field validation (host defaults, mtls topology, header names) lives diff --git a/tests/unit/server-factory.test.ts b/tests/unit/server-factory.test.ts index c246e2b..b6f91fa 100644 --- a/tests/unit/server-factory.test.ts +++ b/tests/unit/server-factory.test.ts @@ -3,7 +3,10 @@ import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'; import { describe, expect, it, vi } from 'vitest'; import type { HorizonClient } from '../../src/client/http.js'; -import { createSessionServer } from '../../src/server-factory.js'; +import { + TOOLSET_NAMES, + createSessionServer, +} from '../../src/server-factory.js'; function mockClient(): HorizonClient { return { @@ -71,3 +74,73 @@ describe('createSessionServer', () => { } }); }); + +describe('createSessionServer toolset gating', () => { + async function listToolNames(server: ReturnType) { + const client = await connect(server); + try { + const { tools } = await client.listTools(); + return tools.map((t) => t.name); + } finally { + await client.close(); + } + } + + it('exposes a representative tool from every toolset by default', async () => { + const names = await listToolNames(createSessionServer(mockClient())); + + // One representative tool per toolset name. + expect(names).toContain('search_certificates'); // lifecycle + expect(names).toContain('list_profiles'); // profiles + expect(names).toContain('list_dashboards'); // dashboards + expect(names).toContain('list_discovery_campaigns'); // discovery + expect(names).toContain('list_datasources'); // datasources + expect(names).toContain('list_reports'); // reports + expect(names).toContain('list_triggers'); // triggers + expect(names).toContain('search_docs'); // docs + expect(names).toContain('whoami'); // assist + expect(names).toContain('create_certificate_profile'); // config + }); + + it('registers only the selected toolsets', async () => { + const names = await listToolNames( + createSessionServer(mockClient(), { enabledToolsets: ['docs'] }), + ); + + expect(names).toContain('search_docs'); + expect(names).toContain('read_knowledge'); + // Tools from other domains are absent. + expect(names).not.toContain('search_certificates'); + expect(names).not.toContain('whoami'); + expect(names).not.toContain('create_certificate_profile'); + }); + + it('throws with the valid list when a toolset name is unknown', () => { + expect(() => + createSessionServer(mockClient(), { + enabledToolsets: ['docs', 'bogus'], + }), + ).toThrow(/bogus/); + expect(() => + createSessionServer(mockClient(), { enabledToolsets: ['bogus'] }), + ).toThrow(new RegExp(TOOLSET_NAMES.join('|'))); + }); + + it('read-only mode strips mutating tools but keeps read-only tools', async () => { + const names = await listToolNames( + createSessionServer(mockClient(), { readOnly: true }), + ); + + // Read-only tools survive. + expect(names).toContain('search_certificates'); + expect(names).toContain('whoami'); + expect(names).toContain('read_knowledge'); + expect(names).toContain('get_certificate'); + + // Mutating tools are stripped. + expect(names).not.toContain('create_certificate_profile'); + expect(names).not.toContain('delete_ca'); + expect(names).not.toContain('update_trigger'); + expect(names).not.toContain('submit_request'); + }); +}); diff --git a/tests/unit/settings.test.ts b/tests/unit/settings.test.ts index 773d44c..29d07d9 100644 --- a/tests/unit/settings.test.ts +++ b/tests/unit/settings.test.ts @@ -173,6 +173,38 @@ describe('loadSettings', () => { }); }); + describe('toolset gating settings', () => { + it('defaults enabledToolsets to undefined and readOnly to false', () => { + const s = loadSettings({}); + expect(s.enabledToolsets).toBeUndefined(); + expect(s.readOnly).toBe(false); + }); + + it('parses HORIZON_ENABLED_TOOLSETS as a trimmed comma list', () => { + const s = loadSettings({ + HORIZON_ENABLED_TOOLSETS: 'lifecycle, docs , assist', + }); + expect(s.enabledToolsets).toEqual(['lifecycle', 'docs', 'assist']); + }); + + it('collapses an empty toolset list to undefined (no filter)', () => { + const s = loadSettings({ HORIZON_ENABLED_TOOLSETS: ' , ,' }); + expect(s.enabledToolsets).toBeUndefined(); + }); + + it("parses HORIZON_READ_ONLY 'true' and '1' as true", () => { + expect(loadSettings({ HORIZON_READ_ONLY: 'true' }).readOnly).toBe(true); + expect(loadSettings({ HORIZON_READ_ONLY: 'TRUE' }).readOnly).toBe(true); + expect(loadSettings({ HORIZON_READ_ONLY: '1' }).readOnly).toBe(true); + }); + + it('parses other HORIZON_READ_ONLY values as false', () => { + expect(loadSettings({ HORIZON_READ_ONLY: 'false' }).readOnly).toBe(false); + expect(loadSettings({ HORIZON_READ_ONLY: '0' }).readOnly).toBe(false); + expect(loadSettings({ HORIZON_READ_ONLY: 'yes' }).readOnly).toBe(false); + }); + }); + describe('HTTP transport settings', () => { it('defaults to stdio transport with safe HTTP defaults', () => { const s = loadSettings({}); From 2d1ae76c76751d747cc981b1ae66c37e608f0fb3 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 2 Jul 2026 12:30:16 +0200 Subject: [PATCH 07/12] chore: track bun.lock, raise CSV e2e timeouts, refresh e2e coverage doc --- tests/e2e/COVERAGE.md | 117 +++++++++++++------------------------- tests/e2e/horizon.test.ts | 6 +- 2 files changed, 43 insertions(+), 80 deletions(-) diff --git a/tests/e2e/COVERAGE.md b/tests/e2e/COVERAGE.md index 77e4d05..8174251 100644 --- a/tests/e2e/COVERAGE.md +++ b/tests/e2e/COVERAGE.md @@ -1,90 +1,53 @@ -# E2E Test Coverage Report +# E2E Test Coverage -## Summary +Last verified: 2026-07-02 against Horizon 2.10 QA (300/301 passing; the one +failure was a CSV export test timeout, fixed by raising the per-test timeout +above the tool's own CSV_TIMEOUT of 120s). -| Scope | Tools | E2E Tests | Coverage | -| --------------------------- | ----- | --------- | -------- | -| **Phase 1 (master)** | 96 | 132 | ~100% | -| **Phase 2 (mcp-extension)** | 120 | 89 | ~75% | -| **Total** | 216 | 221 | ~90% | +## Suite layout (Vitest, tests/e2e/) -## Phase 1 Coverage (master branch) +30 test files, ~301 tests, run with `bun run test:e2e` (source `.env.local` +first for `HORIZON_E2E_URL` / `HORIZON_E2E_API_ID` / `HORIZON_E2E_API_KEY`). +Setup lives in `setup.ts` (builds a HorizonClient from env and a `callTool` +helper that invokes registered MCP tools directly). -All 96 Phase 1 tools have E2E test coverage. +| Area | Files | Tests | Notes | +| ---- | ----- | ----- | ----- | +| Core domains (lifecycle, search, exports, dashboards, discovery, reports, assist) | `horizon.test.ts` | 91 | Includes CRUD lifecycles with cleanup | +| Config CRUD domains | `config-*.test.ts` (27 files) | ~160 | One file per domain: teams, roles, CAs, profiles, labels, DCV, PKI connectors/queues, storages, triggers, proxies, password policies, execution/automation policies, scheduled tasks, terms of service, WCCE forests, archives, grading, identity providers, service accounts, system configuration, third-party connectors, polymorphic subtypes, binding | +| Documentation tools | `docs.test.ts` | 5 | search_docs, search_api_docs, get_doc_page | +| System tools | `system-tools.test.ts` | 2 | whoami, license | -| Module | Tools | Tests | File | Status | -| -------------------- | ----- | ----- | --------------------------- | --------------------- | -| Assist (system) | 4 | 4 | `test_assist.py` | Full | -| Assist (query) | 5 | 9 | `test_assist.py` | Full | -| Assist (crypto) | 3 | 3 | `test_assist.py` | Full | -| Assist (computation) | 2 | 3 | `test_assist.py` | Full | -| Assist (translate) | 1 | 3 | `test_assist.py` | Full | -| Lifecycle | 17 | 16 | `test_lifecycle.py` | Full | -| Dashboards | 12 | 12 | `test_dashboards.py` | Full | -| Discovery campaigns | 6 | 7 | `test_discovery.py` | Full | -| Discovery events | 3 | 3 | `test_discovery.py` | Full | -| Discovery feed | 4 | 1 | `test_discovery.py` | Full (lifecycle test) | -| Reports | 3 | 4 | `test_reports.py` | Full | -| Analytics | 1 | 4 | `test_reports.py` | Full | -| Config (read-only) | 19 | 20 | `test_config_readonly.py` | Full | -| Profiles (Phase 1) | 12 | 5 | `test_profiles.py` | Full | -| Security (read-only) | 4 | 6 | `test_security_readonly.py` | Full | +Mutating tests follow create -> verify -> delete with teardown; nothing is +left behind on the QA instance. -### Knowledge Resources +## LLM evaluation (tests/llm-evaluation/) -All 12 knowledge resources tested for accessibility, content quality, and structure. +| Tier | File | Description | +| ---- | ---- | ----------- | +| Tool selection | `tool-selection.test.ts` + `scenarios.ts` | 18 golden scenarios: right tool picked, disallowed tools avoided, required args present | +| MCP loop | `mcp-loop.test.ts` | Full tool execution loops against live Horizon | +| Smoke | `smoke.test.ts` | Basic integration check | -## Phase 2 Coverage (mcp-extension branch) +Run with `bun run test:llm` (uses `HORIZON_LLM_EVAL_MODEL`, Sonnet by +default). `tests/llm-live/` contains the live tool-selection eval runner. -| Module | Tools | Tests | File | Status | -| ---------------- | ----- | ----- | -------------------------- | ----------------------------------------------- | -| Config (admin) | 15 | 8 | `test_config_admin.py` | Full (label, proxy, password policy CRUD) | -| Security (admin) | 25 | 9 | `test_security_admin.py` | Full (role, team, principal CRUD) | -| Triggers | 8 | 5 | `test_triggers.py` | Full | -| Connectors | 10 | 8 | `test_connectors.py` | Read-only (create needs infrastructure) | -| Automation | 12 | 9 | `test_automation.py` | Partial (execution policy CRUD, rest read-only) | -| Local Identities | 8 | 6 | `test_local_identities.py` | Partial (CRUD + password, skip reset) | -| Scheduler | 8 | 8 | `test_scheduler.py` | Read-only (run skipped) | -| System Config | 6 | 10 | `test_system_config.py` | Full read + export (upsert/import skipped) | -| Archives | 8 | 12 | `test_archives.py` | Read-only (CRUD skipped - long-running) | -| WCCE | 7 | 6 | `test_wcce.py` | Read-only (needs AD infrastructure) | -| Profiles (admin) | 13 | 8 | `test_profiles_admin.py` | Partial (delete + conditional v1B) | +## Known environment-dependent skips -## Infrastructure Gaps +- `horizon.test.ts` discovery feed lifecycle: soft-skips if the feed campaign + returns DISC-CAMP-003 right after creation. +- Discovery import workflow: requires a pre-existing `sbo-claude-qa` campaign + on the target instance; skips when absent. -These tools cannot be fully tested without external infrastructure: +## Infrastructure gaps (cannot be fully E2E-tested) -| Gap | Tools Affected | Reason | -| -------------------- | ---------------------------------------------------- | -------------------------- | -| Active Directory | WCCE create/update/delete, wcce_enroll | Needs AD forest | -| Intune/SCEP | create_intune_profile, update_intune_profile | Needs Microsoft Intune | -| IntunePKCS | create_intunepkcs_profile, update_intunepkcs_profile | Needs Intune PKCS | -| Jamf | create_jamf_profile, update_jamf_profile | Needs Jamf Pro | -| SMTP | Email triggers | No SMTP server in test env | -| PKI Backend | create_pki_connector | Needs ADCS/EJBCA/Vault | -| OIDC Provider | create_identity_provider (openid) | Needs real OIDC IdP | -| Email Infrastructure | initiate/complete_password_reset | Needs email delivery | -| Long-running Jobs | archive CRUD, run_scheduled_task | Side effects, timing | +| Gap | Tools affected | Reason | +| --- | -------------- | ------ | +| Active Directory | WCCE create/update/delete | Needs an AD forest | +| Intune / Jamf | MDM profile create/update | Needs Microsoft Intune / Jamf Pro | +| SMTP | Email triggers | No SMTP server in test env | +| PKI backend | create_pki_connector (live enrollment) | Needs ADCS/EJBCA/Vault | +| OIDC provider | identity provider (openid) | Needs a real OIDC IdP | +| Long-running jobs | archive CRUD, run_scheduled_task | Side effects, timing | -## LLM Evaluation - -| Tier | Tests | Description | -| ----------------------- | ----- | --------------------------------------------------- | -| Tier 1 - Tool Selection | 10 | Golden scenarios: does Claude pick the right tools? | -| Tier 2 - MCP Loop | 4 | Full tool execution against live Horizon | -| Tier 3 - Smoke | 2 | Basic Claude Code integration check | - -## Running Tests - -```bash -# Unit tests only (no external deps) -pytest tests/ -m "not e2e and not llm_evaluation" -q - -# Phase 1 E2E (needs Horizon QA instance) -HORIZON_E2E_URL=... HORIZON_E2E_API_ID=... HORIZON_E2E_API_KEY=... \ - pytest -m e2e tests/e2e/ -v - -# LLM evaluation (needs Claude Code + Horizon QA) -HORIZON_E2E_URL=... HORIZON_E2E_API_ID=... HORIZON_E2E_API_KEY=... \ - pytest -m llm_evaluation -v -``` +These are exercised read-only or with validation-level assertions instead. diff --git a/tests/e2e/horizon.test.ts b/tests/e2e/horizon.test.ts index af597bd..3c7c19c 100644 --- a/tests/e2e/horizon.test.ts +++ b/tests/e2e/horizon.test.ts @@ -245,7 +245,7 @@ describe.skipIf(!E2E_CONFIGURED)('Horizon E2E', () => { expect(result['truncated']).toBeDefined(); expect(result['returned_rows']).toBeDefined(); expect(typeof result['csv']).toBe('string'); - }); + }, 150_000); it('exports requests as CSV', async () => { const result = await callTool('export_requests_csv', { @@ -257,7 +257,7 @@ describe.skipIf(!E2E_CONFIGURED)('Horizon E2E', () => { ).toBeDefined(); expect(result['truncated']).toBeDefined(); expect(typeof result['csv']).toBe('string'); - }); + }, 150_000); it('exports events as CSV', async () => { const result = await callTool( @@ -274,7 +274,7 @@ describe.skipIf(!E2E_CONFIGURED)('Horizon E2E', () => { expect(result['max_rows']).toBe(1000); expect(typeof result['csv']).toBe('string'); expect(result['returned_rows'] as number).toBeLessThanOrEqual(1000); - }, 120_000); + }, 150_000); }); // ----------------------------------------------------------------------- From 1e87745e75425fdc821d8663782c370dabe3b940 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 2 Jul 2026 12:33:12 +0200 Subject: [PATCH 08/12] style: format e2e coverage doc --- tests/e2e/COVERAGE.md | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/tests/e2e/COVERAGE.md b/tests/e2e/COVERAGE.md index 8174251..5845c8e 100644 --- a/tests/e2e/COVERAGE.md +++ b/tests/e2e/COVERAGE.md @@ -11,23 +11,23 @@ first for `HORIZON_E2E_URL` / `HORIZON_E2E_API_ID` / `HORIZON_E2E_API_KEY`). Setup lives in `setup.ts` (builds a HorizonClient from env and a `callTool` helper that invokes registered MCP tools directly). -| Area | Files | Tests | Notes | -| ---- | ----- | ----- | ----- | -| Core domains (lifecycle, search, exports, dashboards, discovery, reports, assist) | `horizon.test.ts` | 91 | Includes CRUD lifecycles with cleanup | -| Config CRUD domains | `config-*.test.ts` (27 files) | ~160 | One file per domain: teams, roles, CAs, profiles, labels, DCV, PKI connectors/queues, storages, triggers, proxies, password policies, execution/automation policies, scheduled tasks, terms of service, WCCE forests, archives, grading, identity providers, service accounts, system configuration, third-party connectors, polymorphic subtypes, binding | -| Documentation tools | `docs.test.ts` | 5 | search_docs, search_api_docs, get_doc_page | -| System tools | `system-tools.test.ts` | 2 | whoami, license | +| Area | Files | Tests | Notes | +| --------------------------------------------------------------------------------- | ----------------------------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Core domains (lifecycle, search, exports, dashboards, discovery, reports, assist) | `horizon.test.ts` | 91 | Includes CRUD lifecycles with cleanup | +| Config CRUD domains | `config-*.test.ts` (27 files) | ~160 | One file per domain: teams, roles, CAs, profiles, labels, DCV, PKI connectors/queues, storages, triggers, proxies, password policies, execution/automation policies, scheduled tasks, terms of service, WCCE forests, archives, grading, identity providers, service accounts, system configuration, third-party connectors, polymorphic subtypes, binding | +| Documentation tools | `docs.test.ts` | 5 | search_docs, search_api_docs, get_doc_page | +| System tools | `system-tools.test.ts` | 2 | whoami, license | Mutating tests follow create -> verify -> delete with teardown; nothing is left behind on the QA instance. ## LLM evaluation (tests/llm-evaluation/) -| Tier | File | Description | -| ---- | ---- | ----------- | +| Tier | File | Description | +| -------------- | ----------------------------------------- | --------------------------------------------------------------------------------------- | | Tool selection | `tool-selection.test.ts` + `scenarios.ts` | 18 golden scenarios: right tool picked, disallowed tools avoided, required args present | -| MCP loop | `mcp-loop.test.ts` | Full tool execution loops against live Horizon | -| Smoke | `smoke.test.ts` | Basic integration check | +| MCP loop | `mcp-loop.test.ts` | Full tool execution loops against live Horizon | +| Smoke | `smoke.test.ts` | Basic integration check | Run with `bun run test:llm` (uses `HORIZON_LLM_EVAL_MODEL`, Sonnet by default). `tests/llm-live/` contains the live tool-selection eval runner. @@ -41,13 +41,13 @@ default). `tests/llm-live/` contains the live tool-selection eval runner. ## Infrastructure gaps (cannot be fully E2E-tested) -| Gap | Tools affected | Reason | -| --- | -------------- | ------ | -| Active Directory | WCCE create/update/delete | Needs an AD forest | -| Intune / Jamf | MDM profile create/update | Needs Microsoft Intune / Jamf Pro | -| SMTP | Email triggers | No SMTP server in test env | -| PKI backend | create_pki_connector (live enrollment) | Needs ADCS/EJBCA/Vault | -| OIDC provider | identity provider (openid) | Needs a real OIDC IdP | -| Long-running jobs | archive CRUD, run_scheduled_task | Side effects, timing | +| Gap | Tools affected | Reason | +| ----------------- | -------------------------------------- | --------------------------------- | +| Active Directory | WCCE create/update/delete | Needs an AD forest | +| Intune / Jamf | MDM profile create/update | Needs Microsoft Intune / Jamf Pro | +| SMTP | Email triggers | No SMTP server in test env | +| PKI backend | create_pki_connector (live enrollment) | Needs ADCS/EJBCA/Vault | +| OIDC provider | identity provider (openid) | Needs a real OIDC IdP | +| Long-running jobs | archive CRUD, run_scheduled_task | Side effects, timing | These are exercised read-only or with validation-level assertions instead. From f204953f59d0d7cb3f8abe5aebfee8ce231cf2d2 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 2 Jul 2026 13:08:26 +0200 Subject: [PATCH 09/12] chore: refresh doc snapshots --- src/generated/docs/api-doc-pages.json | 50 ++++++++++----------- src/generated/docs/companion-doc-pages.json | 43 ++++++++++++++---- src/generated/docs/doc-versions.json | 2 +- src/generated/docs/product-doc-pages.json | 2 +- 4 files changed, 61 insertions(+), 36 deletions(-) diff --git a/src/generated/docs/api-doc-pages.json b/src/generated/docs/api-doc-pages.json index b10febb..abd70d9 100644 --- a/src/generated/docs/api-doc-pages.json +++ b/src/generated/docs/api-doc-pages.json @@ -1,5 +1,5 @@ { - "generatedAt": "2026-07-01T08:11:06.995Z", + "generatedAt": "2026-07-02T11:05:54.440Z", "pageCount": 1502, "pages": [ { @@ -672,7 +672,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -747,7 +747,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -785,7 +785,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -823,7 +823,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -2259,7 +2259,7 @@ "List DCV lifecycle events for a policy" ], "summary": "List DCV lifecycle events for a policy Retrieve DCV lifecycle events for a given policy with pagination Path parameters policy string required Name of the DCV policy Body required application/json sortedBy array of objects | null (SortEleme", - "content": "List DCV lifecycle events for a policy\n\n Retrieve DCV lifecycle events for a given policy with pagination\n\n Path parameters\n\n policy\n\n string\n required\n\n Name of the DCV policy\n\n Body\n required\n\napplication/json\n\n sortedBy\n\n array of objects | null (SortElement)\n +\n\n Array [\n\n element\n\n string\n required\n\n The name of the field the query should be sorted by. Must be one of the fields of the search query\n\n order\n\n string\n required\n\n The order to use for the sort. Asc and Desc sort the values, and KeyAsc and KeyDesc sort by the key, in case of a key-value element\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n ]\n\n pageIndex\n\n integer | null\n\n pageSize\n\n integer | null\n\n withCount\n\n boolean | null\n\n Responses\n\n 200\n Paginated list of DCV lifecycle events for the policy\n\napplication/json\n\n results\n\n array of objects (DCVLifecycleEvent)\n required +\n\n Array [\n\n status\n\n string\n required\n\n Enum\n started\n success\n failure\n retrying\n blocked\n\n timestamp\n\n string\n required\n\n Timestamp linked to the validation\n\n domain\n\n string\n required\n\n The domain\n\n policy\n\n string\n required\n\n The DCV policy name\n\n removeAt\n\n string\n required\n\n Timestamp when the event will be removed\n\n attempt\n\n integer\n\n Current retry attempt count\n\n lastError\n\n string | null\n\n Error message from the previous attempt\n\n msg\n\n string\n\n Error message describing the failure cause\n\n ]\n\n pageIndex\n\n integer\n required\n\n pageSize\n\n integer\n required\n\n hasMore\n\n boolean\n required\n\n count\n\n integer | null\n\n 204\n No events found for this policy\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-006\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n DCV policy not found\n\napplication/problem+json\n\n DCV-LIFECYCLE-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DCV Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DCV Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DCV-LIFECYCLE-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/dcv/lifecycle/events/{policy}\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"sortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"withCount\":\n true\n\n }\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"results\":\n\n +\n\n [\n\n +\n\n {\n\n \"status\":\n \"started\"\n ,\n\n \"timestamp\":\n \"2026-06-26T08:41:07.310Z\"\n ,\n\n \"domain\":\n \"string\"\n ,\n\n \"policy\":\n \"string\"\n ,\n\n \"removeAt\":\n \"2026-06-26T08:41:07.310Z\"\n ,\n\n \"attempt\":\n 0\n ,\n\n \"lastError\":\n \"string\"\n ,\n\n \"msg\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"count\":\n 0\n ,\n\n \"hasMore\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-002\"\n ,\n\n \"message\":\n \"DCV Policy not found\"\n ,\n\n \"title\":\n \"DCV Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Cancel an active DCV policy run\n List DCV lifecycle events for a specific domain", + "content": "List DCV lifecycle events for a policy\n\n Retrieve DCV lifecycle events for a given policy with pagination\n\n Path parameters\n\n policy\n\n string\n required\n\n Name of the DCV policy\n\n Body\n required\n\napplication/json\n\n sortedBy\n\n array of objects | null (SortElement)\n +\n\n Array [\n\n element\n\n string\n required\n\n The name of the field the query should be sorted by. Must be one of the fields of the search query\n\n order\n\n string\n required\n\n The order to use for the sort. Asc and Desc sort the values, and KeyAsc and KeyDesc sort by the key, in case of a key-value element\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n ]\n\n pageIndex\n\n integer | null\n\n pageSize\n\n integer | null\n\n withCount\n\n boolean | null\n\n Responses\n\n 200\n Paginated list of DCV lifecycle events for the policy\n\napplication/json\n\n results\n\n array of objects (DCVLifecycleEvent)\n required +\n\n Array [\n\n status\n\n string\n required\n\n Enum\n started\n success\n failure\n retrying\n blocked\n\n timestamp\n\n string\n required\n\n Timestamp linked to the validation\n\n domain\n\n string\n required\n\n The domain\n\n policy\n\n string\n required\n\n The DCV policy name\n\n removeAt\n\n string\n required\n\n Timestamp when the event will be removed\n\n attempt\n\n integer\n\n Current retry attempt count\n\n lastError\n\n string | null\n\n Error message from the previous attempt\n\n msg\n\n string\n\n Error message describing the failure cause\n\n ]\n\n pageIndex\n\n integer\n required\n\n pageSize\n\n integer\n required\n\n hasMore\n\n boolean\n required\n\n count\n\n integer | null\n\n 204\n No events found for this policy\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-006\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n DCV policy not found\n\napplication/problem+json\n\n DCV-LIFECYCLE-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DCV Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DCV Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DCV-LIFECYCLE-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/dcv/lifecycle/events/{policy}\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"sortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"withCount\":\n true\n\n }\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"results\":\n\n +\n\n [\n\n +\n\n {\n\n \"status\":\n \"started\"\n ,\n\n \"timestamp\":\n \"2026-07-02T08:31:29.950Z\"\n ,\n\n \"domain\":\n \"string\"\n ,\n\n \"policy\":\n \"string\"\n ,\n\n \"removeAt\":\n \"2026-07-02T08:31:29.950Z\"\n ,\n\n \"attempt\":\n 0\n ,\n\n \"lastError\":\n \"string\"\n ,\n\n \"msg\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"count\":\n 0\n ,\n\n \"hasMore\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-002\"\n ,\n\n \"message\":\n \"DCV Policy not found\"\n ,\n\n \"title\":\n \"DCV Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Cancel an active DCV policy run\n List DCV lifecycle events for a specific domain", "keywords": [ "list", "dcv", @@ -2297,7 +2297,7 @@ "List DCV lifecycle events for a specific domain" ], "summary": "List DCV lifecycle events for a specific domain Retrieve DCV lifecycle events for a specific domain under a given policy with pagination Path parameters policy string required Name of the DCV policy domain string required The domain hostnam", - "content": "List DCV lifecycle events for a specific domain\n\n Retrieve DCV lifecycle events for a specific domain under a given policy with pagination\n\n Path parameters\n\n policy\n\n string\n required\n\n Name of the DCV policy\n\n domain\n\n string\n required\n\n The domain hostname to retrieve events for\n\n Body\n required\n\napplication/json\n\n sortedBy\n\n array of objects | null (SortElement)\n +\n\n Array [\n\n element\n\n string\n required\n\n The name of the field the query should be sorted by. Must be one of the fields of the search query\n\n order\n\n string\n required\n\n The order to use for the sort. Asc and Desc sort the values, and KeyAsc and KeyDesc sort by the key, in case of a key-value element\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n ]\n\n pageIndex\n\n integer | null\n\n pageSize\n\n integer | null\n\n withCount\n\n boolean | null\n\n Responses\n\n 200\n Paginated list of DCV lifecycle events for the domain\n\napplication/json\n\n results\n\n array of objects (DCVLifecycleEvent)\n required +\n\n Array [\n\n status\n\n string\n required\n\n Enum\n started\n success\n failure\n retrying\n blocked\n\n timestamp\n\n string\n required\n\n Timestamp linked to the validation\n\n domain\n\n string\n required\n\n The domain\n\n policy\n\n string\n required\n\n The DCV policy name\n\n removeAt\n\n string\n required\n\n Timestamp when the event will be removed\n\n attempt\n\n integer\n\n Current retry attempt count\n\n lastError\n\n string | null\n\n Error message from the previous attempt\n\n msg\n\n string\n\n Error message describing the failure cause\n\n ]\n\n pageIndex\n\n integer\n required\n\n pageSize\n\n integer\n required\n\n hasMore\n\n boolean\n required\n\n count\n\n integer | null\n\n 204\n No events found for this domain\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-006\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n DCV policy not found\n\napplication/problem+json\n\n DCV-LIFECYCLE-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DCV Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DCV Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DCV-LIFECYCLE-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/dcv/lifecycle/events/{policy}/{domain}\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"sortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"withCount\":\n true\n\n }\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"results\":\n\n +\n\n [\n\n +\n\n {\n\n \"status\":\n \"started\"\n ,\n\n \"timestamp\":\n \"2026-06-26T08:41:07.310Z\"\n ,\n\n \"domain\":\n \"string\"\n ,\n\n \"policy\":\n \"string\"\n ,\n\n \"removeAt\":\n \"2026-06-26T08:41:07.310Z\"\n ,\n\n \"attempt\":\n 0\n ,\n\n \"lastError\":\n \"string\"\n ,\n\n \"msg\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"count\":\n 0\n ,\n\n \"hasMore\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-002\"\n ,\n\n \"message\":\n \"DCV Policy not found\"\n ,\n\n \"title\":\n \"DCV Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n List DCV lifecycle events for a policy\n DCV Providers", + "content": "List DCV lifecycle events for a specific domain\n\n Retrieve DCV lifecycle events for a specific domain under a given policy with pagination\n\n Path parameters\n\n policy\n\n string\n required\n\n Name of the DCV policy\n\n domain\n\n string\n required\n\n The domain hostname to retrieve events for\n\n Body\n required\n\napplication/json\n\n sortedBy\n\n array of objects | null (SortElement)\n +\n\n Array [\n\n element\n\n string\n required\n\n The name of the field the query should be sorted by. Must be one of the fields of the search query\n\n order\n\n string\n required\n\n The order to use for the sort. Asc and Desc sort the values, and KeyAsc and KeyDesc sort by the key, in case of a key-value element\n\n Enum\n Asc\n Desc\n KeyAsc\n KeyDesc\n\n ]\n\n pageIndex\n\n integer | null\n\n pageSize\n\n integer | null\n\n withCount\n\n boolean | null\n\n Responses\n\n 200\n Paginated list of DCV lifecycle events for the domain\n\napplication/json\n\n results\n\n array of objects (DCVLifecycleEvent)\n required +\n\n Array [\n\n status\n\n string\n required\n\n Enum\n started\n success\n failure\n retrying\n blocked\n\n timestamp\n\n string\n required\n\n Timestamp linked to the validation\n\n domain\n\n string\n required\n\n The domain\n\n policy\n\n string\n required\n\n The DCV policy name\n\n removeAt\n\n string\n required\n\n Timestamp when the event will be removed\n\n attempt\n\n integer\n\n Current retry attempt count\n\n lastError\n\n string | null\n\n Error message from the previous attempt\n\n msg\n\n string\n\n Error message describing the failure cause\n\n ]\n\n pageIndex\n\n integer\n required\n\n pageSize\n\n integer\n required\n\n hasMore\n\n boolean\n required\n\n count\n\n integer | null\n\n 204\n No events found for this domain\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-006\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n DCV policy not found\n\napplication/problem+json\n\n DCV-LIFECYCLE-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DCV Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DCV Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n DCV-LIFECYCLE-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n DCV-LIFECYCLE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/dcv/lifecycle/events/{policy}/{domain}\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"sortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"withCount\":\n true\n\n }\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"results\":\n\n +\n\n [\n\n +\n\n {\n\n \"status\":\n \"started\"\n ,\n\n \"timestamp\":\n \"2026-07-02T08:31:29.950Z\"\n ,\n\n \"domain\":\n \"string\"\n ,\n\n \"policy\":\n \"string\"\n ,\n\n \"removeAt\":\n \"2026-07-02T08:31:29.950Z\"\n ,\n\n \"attempt\":\n 0\n ,\n\n \"lastError\":\n \"string\"\n ,\n\n \"msg\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pageIndex\":\n 0\n ,\n\n \"pageSize\":\n 0\n ,\n\n \"count\":\n 0\n ,\n\n \"hasMore\":\n true\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-002\"\n ,\n\n \"message\":\n \"DCV Policy not found\"\n ,\n\n \"title\":\n \"DCV Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"DCV-LIFECYCLE-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n List DCV lifecycle events for a policy\n DCV Providers", "keywords": [ "list", "dcv", @@ -5243,7 +5243,7 @@ "Export configuration items" ], "summary": "Export configuration items Export configuration items Body required application/json Items to export cas array of object | null (HorizonExportableItemsSeq) + Array [ name string required displayName array of objects | null (LocalizedString)", - "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n storages\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n identifierMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal identifier when a certificate from this CA is used for client authentication\n\n nameMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal name when a certificate from this CA is used for client authentication\n\n emailMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal email when a certificate from this CA is used for client authentication\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template.\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n storages\n\n array of objects (S3 Storage)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name for this storage\n\n type\n\n string\n required\n\n Type of storage\n\n Value\n s3\n\n timeout\n\n string | null (FiniteDuration)\n required\n\n Timeout while connecting to the S3\n\n forcePathStyle\n\n boolean\n required\n\n If enabled, force S3 path style requests\n\n bucket\n\n string\n required\n\n Name of the bucket to store items into\n\n partBufferSize\n\n string\n required\n\n credentials\n\n string\n\n Name of the password credentials containing AWS Secret Keys. If not defined, environment variables will be used\n\n roleArn\n\n string\n\n AWS Role ARN to impersonate\n\n region\n\n string\n\n AWS Region for the S3 storage. If not defined, environment variables will be used\n\n description\n\n string\n\n Simple description for this storage\n\n proxy\n\n string\n\n Reference to the proxy to use for connection to the S3\n\n endpoint\n\n string\n\n Custom endpoint to use for S3\n\n checksumMode\n\n string\n\n S3 Checksum mode\n\n Enum\n when_supported\n when_required\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n ,\n\n \"identifierMapping\":\n \"{{certificate.dn}}\"\n ,\n\n \"nameMapping\":\n \"{{certificate.subject.cn.1}}\"\n ,\n\n \"emailMapping\":\n \"{{certificate.san.rfc822name.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n ,\n\n \"mandatory\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"s3\"\n ,\n\n \"credentials\":\n \"aws-credentials\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"endpoint\":\n \"string\"\n ,\n\n \"forcePathStyle\":\n false\n ,\n\n \"bucket\":\n \"string\"\n ,\n\n \"checksumMode\":\n \"when_required\"\n ,\n\n \"partBufferSize\":\n \"9MB\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", + "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n storages\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n identifierMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal identifier when a certificate from this CA is used for client authentication\n\n nameMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal name when a certificate from this CA is used for client authentication\n\n emailMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal email when a certificate from this CA is used for client authentication\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template.\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n storages\n\n array of objects (S3 Storage)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name for this storage\n\n type\n\n string\n required\n\n Type of storage\n\n Value\n s3\n\n timeout\n\n string | null (FiniteDuration)\n required\n\n Timeout while connecting to the S3\n\n forcePathStyle\n\n boolean\n required\n\n If enabled, force S3 path style requests\n\n bucket\n\n string\n required\n\n Name of the bucket to store items into\n\n partBufferSize\n\n string\n required\n\n credentials\n\n string\n\n Name of the password credentials containing AWS Secret Keys. If not defined, environment variables will be used\n\n roleArn\n\n string\n\n AWS Role ARN to impersonate\n\n region\n\n string\n\n AWS Region for the S3 storage. If not defined, environment variables will be used\n\n description\n\n string\n\n Simple description for this storage\n\n proxy\n\n string\n\n Reference to the proxy to use for connection to the S3\n\n endpoint\n\n string\n\n Custom endpoint to use for S3\n\n checksumMode\n\n string\n\n S3 Checksum mode\n\n Enum\n when_supported\n when_required\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n ,\n\n \"identifierMapping\":\n \"{{certificate.dn}}\"\n ,\n\n \"nameMapping\":\n \"{{certificate.subject.cn.1}}\"\n ,\n\n \"emailMapping\":\n \"{{certificate.san.rfc822name.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n ,\n\n \"mandatory\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"s3\"\n ,\n\n \"credentials\":\n \"aws-credentials\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"endpoint\":\n \"string\"\n ,\n\n \"forcePathStyle\":\n false\n ,\n\n \"bucket\":\n \"string\"\n ,\n\n \"checksumMode\":\n \"when_required\"\n ,\n\n \"partBufferSize\":\n \"9MB\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", "keywords": [ "export", "configuration", @@ -5278,7 +5278,7 @@ "Import configuration items" ], "summary": "Import configuration items Import configuration items Body required application/json Items to import info object + createdAt string version string items object (Horizon Exportable Items) + cas array of objects (Certificate Authority) + Arra", - "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n identifierMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal identifier when a certificate from this CA is used for client authentication\n\n nameMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal name when a certificate from this CA is used for client authentication\n\n emailMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal email when a certificate from this CA is used for client authentication\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template.\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n storages\n\n array of objects (S3 Storage)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name for this storage\n\n type\n\n string\n required\n\n Type of storage\n\n Value\n s3\n\n timeout\n\n string | null (FiniteDuration)\n required\n\n Timeout while connecting to the S3\n\n forcePathStyle\n\n boolean\n required\n\n If enabled, force S3 path style requests\n\n bucket\n\n string\n required\n\n Name of the bucket to store items into\n\n partBufferSize\n\n string\n required\n\n credentials\n\n string\n\n Name of the password credentials containing AWS Secret Keys. If not defined, environment variables will be used\n\n roleArn\n\n string\n\n AWS Role ARN to impersonate\n\n region\n\n string\n\n AWS Region for the S3 storage. If not defined, environment variables will be used\n\n description\n\n string\n\n Simple description for this storage\n\n proxy\n\n string\n\n Reference to the proxy to use for connection to the S3\n\n endpoint\n\n string\n\n Custom endpoint to use for S3\n\n checksumMode\n\n string\n\n S3 Checksum mode\n\n Enum\n when_supported\n when_required\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n ,\n\n \"identifierMapping\":\n \"{{certificate.dn}}\"\n ,\n\n \"nameMapping\":\n \"{{certificate.subject.cn.1}}\"\n ,\n\n \"emailMapping\":\n \"{{certificate.san.rfc822name.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n ,\n\n \"mandatory\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"s3\"\n ,\n\n \"credentials\":\n \"aws-credentials\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"endpoint\":\n \"string\"\n ,\n\n \"forcePathStyle\":\n false\n ,\n\n \"bucket\":\n \"string\"\n ,\n\n \"checksumMode\":\n \"when_required\"\n ,\n\n \"partBufferSize\":\n \"9MB\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Storages", + "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n identifierMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal identifier when a certificate from this CA is used for client authentication\n\n nameMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal name when a certificate from this CA is used for client authentication\n\n emailMapping\n\n string (TemplateString)\n\n A template string to apply to determine the principal email when a certificate from this CA is used for client authentication\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template.\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n storages\n\n array of objects (S3 Storage)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name for this storage\n\n type\n\n string\n required\n\n Type of storage\n\n Value\n s3\n\n timeout\n\n string | null (FiniteDuration)\n required\n\n Timeout while connecting to the S3\n\n forcePathStyle\n\n boolean\n required\n\n If enabled, force S3 path style requests\n\n bucket\n\n string\n required\n\n Name of the bucket to store items into\n\n partBufferSize\n\n string\n required\n\n credentials\n\n string\n\n Name of the password credentials containing AWS Secret Keys. If not defined, environment variables will be used\n\n roleArn\n\n string\n\n AWS Role ARN to impersonate\n\n region\n\n string\n\n AWS Region for the S3 storage. If not defined, environment variables will be used\n\n description\n\n string\n\n Simple description for this storage\n\n proxy\n\n string\n\n Reference to the proxy to use for connection to the S3\n\n endpoint\n\n string\n\n Custom endpoint to use for S3\n\n checksumMode\n\n string\n\n S3 Checksum mode\n\n Enum\n when_supported\n when_required\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n ,\n\n \"identifierMapping\":\n \"{{certificate.dn}}\"\n ,\n\n \"nameMapping\":\n \"{{certificate.subject.cn.1}}\"\n ,\n\n \"emailMapping\":\n \"{{certificate.san.rfc822name.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n ,\n\n \"mandatory\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"storages\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"s3\"\n ,\n\n \"credentials\":\n \"aws-credentials\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"endpoint\":\n \"string\"\n ,\n\n \"forcePathStyle\":\n false\n ,\n\n \"bucket\":\n \"string\"\n ,\n\n \"checksumMode\":\n \"when_required\"\n ,\n\n \"partBufferSize\":\n \"9MB\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Storages", "keywords": [ "import", "configuration", @@ -25976,7 +25976,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -26051,7 +26051,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -26089,7 +26089,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -26127,7 +26127,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -34595,7 +34595,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -34670,7 +34670,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -34708,7 +34708,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -34746,7 +34746,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -38093,7 +38093,7 @@ "Export configuration items" ], "summary": "Export configuration items Export configuration items Body required application/json Items to export cas array of object | null (HorizonExportableItemsSeq) + Array [ name string required displayName array of objects | null (LocalizedString)", - "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", + "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", "keywords": [ "export", "configuration", @@ -38128,7 +38128,7 @@ "Import configuration items" ], "summary": "Import configuration items Import configuration items Body required application/json Items to import info object + createdAt string version string items object (Horizon Exportable Items) + cas array of objects (Certificate Authority) + Arra", - "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", + "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", "keywords": [ "import", "configuration", @@ -44068,7 +44068,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -44143,7 +44143,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -44181,7 +44181,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -44219,7 +44219,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -47591,7 +47591,7 @@ "Export configuration items" ], "summary": "Export configuration items Export configuration items Body required application/json Items to export cas array of object | null (HorizonExportableItemsSeq) + Array [ name string required displayName array of objects | null (LocalizedString)", - "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", + "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", "keywords": [ "export", "configuration", @@ -47626,7 +47626,7 @@ "Import configuration items" ], "summary": "Import configuration items Import configuration items Body required application/json Items to import info object + createdAt string version string items object (Horizon Exportable Items) + cas array of objects (Certificate Authority) + Arra", - "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-06-26\"\n ,\n\n \"end\":\n \"2026-06-26\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", + "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenceUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-07-02\"\n ,\n\n \"end\":\n \"2026-07-02\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", "keywords": [ "import", "configuration", diff --git a/src/generated/docs/companion-doc-pages.json b/src/generated/docs/companion-doc-pages.json index 198c2c1..ca7ede8 100644 --- a/src/generated/docs/companion-doc-pages.json +++ b/src/generated/docs/companion-doc-pages.json @@ -1,6 +1,6 @@ { - "generatedAt": "2026-07-01T08:11:06.995Z", - "pageCount": 160, + "generatedAt": "2026-07-02T11:05:54.440Z", + "pageCount": 161, "pages": [ { "page_id": "adcs-connector:1:install-guide:initial-config", @@ -1774,7 +1774,7 @@ "Horizon Cli 1.14.0 release notes" ], "summary": "Horizon Cli 1.14.0 release notes Here are the release notes for EverTrust Horizon Client v1.14.0, released on 2025-12-19. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-2", - "content": "Horizon Cli 1.14.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.14.0, released on 2025-12-19.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-257] - Netimport: Now supports Nameshield\n\n [HOR-247] - Automation: certificate chain order can now be specified\n\n [HOR-245] - Automation: KDB can now be used with the generic target, on machines that contain the required IBM utilities\n\n 2. Enhancements\n\n [HOR-365] - Netimport: HashiCorp Vault namespaces are now supported\n\n [HOR-131] - Automation: when enrolling, the --auto-renew task can now be created for a specific user using the --user parameter\n\n 3. Bug Fixes\n\n [HOR-244] - Fixed a bug where using the generic target with the --no-install parameter would raise an error\n\n [HOR-225] - Fixed a bug where ACME certificates would not contain the expected C and OU DN parameters when renewed\n\n [HOR-219] - Fixed a bug where the configuration folder was not properly detected when using the tomcat target\n\n [HOR-249] - Fixed a bug where AKV netimport would raise an error\n\n [HOR-259] - Fixed a bug where saving a certificate to the store would rarely result in a crash\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n An issue with MSI packaging in this version makes it impossible to uninstall. This issue does not affect version 1.14.1 . To resolve it, upgrade to 1.14.1 and then uninstall.\n\n Horizon Cli 1.14.1 release notes", + "content": "Horizon Cli 1.14.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.14.0, released on 2025-12-19.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-257] - Netimport: Now supports Nameshield\n\n [HOR-247] - Automation: certificate chain order can now be specified\n\n [HOR-245] - Automation: KDB can now be used with the generic target, on machines that contain the required IBM utilities\n\n 2. Enhancements\n\n [HOR-365] - Netimport: HashiCorp Vault namespaces are now supported\n\n [HOR-131] - Automation: when enrolling, the --auto-renew task can now be created for a specific user using the --user parameter\n\n 3. Bug Fixes\n\n [HOR-244] - Fixed a bug where using the generic target with the --no-install parameter would raise an error\n\n [HOR-225] - Fixed a bug where ACME certificates would not contain the expected C and OU DN parameters when renewed\n\n [HOR-219] - Fixed a bug where the configuration folder was not properly detected when using the tomcat target\n\n [HOR-249] - Fixed a bug where AKV netimport would raise an error\n\n [HOR-259] - Fixed a bug where saving a certificate to the store would rarely result in a crash\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n An issue with MSI packaging in this version makes it impossible to uninstall. This issue does not affect version 1.14.1 . To resolve it, upgrade to 1.14.1 and then uninstall.\n\n Defects in the chain order feature cause the chain to reset to root-to-leaf order after renewal. This may have a significant operational impact. This affects:\n\n Certificates under management prior to version 1.14.0\n\n Certificates controlled with the automate control command. Fixed in version 1.17.1\n\n The issue is currently being addressed, and a fixed version will be available soon.\n\n Horizon Cli 1.14.1 release notes", "keywords": [ "horizon", "cli", @@ -1803,7 +1803,7 @@ "Horizon Cli 1.14.1 release notes" ], "summary": "Horizon Cli 1.14.1 release notes Here are the release notes for EverTrust Horizon Client v1.14.1, released on 2026-01-09. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon Cli 1.14.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.14.1, released on 2026-01-09.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-359] - NetImport F5: added the --merge-third-party option to improve third party data tracking. Learn more…​\n\n 3. Bug Fixes\n\n [None]\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.14.0 release notes", + "content": "Horizon Cli 1.14.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.14.1, released on 2026-01-09.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-359] - NetImport F5: added the --merge-third-party option to improve third party data tracking. Learn more…​\n\n 3. Bug Fixes\n\n [None]\n\n 4. Reworked features\n\n [None]\n\n 5. Known defects\n\n Defects in the chain order feature cause the chain to reset to root-to-leaf order after renewal. This may have a significant operational impact. This affects:\n\n Certificates under management prior to version 1.14.0\n\n Certificates controlled with the automate control command. Fixed in version 1.17.1\n\n The issue is currently being addressed, and a fixed version will be available soon.\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.14.0 release notes", "keywords": [ "horizon", "cli", @@ -2083,7 +2083,7 @@ "Horizon Cli 1.15.0 release notes" ], "summary": "Horizon Cli 1.15.0 release notes Here are the release notes for EverTrust Horizon Client v1.15.0, released on 2026-02-16. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-6", - "content": "Horizon Cli 1.15.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.15.0, released on 2026-02-16.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-607] - Automation: --pfx-strength and --pfx-alias options allow defining the encryption level and alias for PKCS#12 files\n\n [HOR-521] - Automation: added --chain-key-bundle for generic enrollments to bundle the chain and private key in a single file\n\n [HOR-251] - Automation: added support for Evertrust’s WebRA protocol\n\n 2. Enhancements\n\n [HOR-553] - EST: --cn is no longer mandatory when using challenge mode\n\n [HOR-719] - Localscan: --exclude-default-paths is now available to exclude default localscan paths\n\n [HOR-733] - Keystores: improved JKS and KDB support to allow new alias creation as well as multiple aliases in the same file\n\n [HOR-731] - Added KDB support on all protocols\n\n [HOR-643] - Automate Remove: certificates can now be targeted by serial number using the --serials option\n\n 3. Bug Fixes\n\n [HOR-707] - KDB flags are now present in automate control help\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Horizon-cli 1.15.1 release notes", + "content": "Horizon Cli 1.15.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.15.0, released on 2026-02-16.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-607] - Automation: --pfx-strength and --pfx-alias options allow defining the encryption level and alias for PKCS#12 files\n\n [HOR-521] - Automation: added --chain-key-bundle for generic enrollments to bundle the chain and private key in a single file\n\n [HOR-251] - Automation: added support for Evertrust’s WebRA protocol\n\n 2. Enhancements\n\n [HOR-553] - EST: --cn is no longer mandatory when using challenge mode\n\n [HOR-719] - Localscan: --exclude-default-paths is now available to exclude default localscan paths\n\n [HOR-733] - Keystores: improved JKS and KDB support to allow new alias creation as well as multiple aliases in the same file\n\n [HOR-731] - Added KDB support on all protocols\n\n [HOR-643] - Automate Remove: certificates can now be targeted by serial number using the --serials option\n\n 3. Bug Fixes\n\n [HOR-707] - KDB flags are now present in automate control help\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n Defects in the chain order feature cause the chain to reset to root-to-leaf order after renewal. This may have a significant operational impact. This affects:\n\n Certificates under management prior to version 1.14.0\n\n Certificates controlled with the automate control command. Fixed in version 1.17.1\n\n The issue is currently being addressed, and a fixed version will be available soon.\n\n Horizon-cli 1.15.1 release notes", "keywords": [ "horizon", "cli", @@ -2112,7 +2112,7 @@ "Horizon-cli 1.15.1 release notes" ], "summary": "Horizon-cli 1.15.1 release notes Here are the release notes for EverTrust Horizon Client v1.15.1, released on 2026-02-27. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", - "content": "Horizon-cli 1.15.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.15.1, released on 2026-02-27.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-843] - KDB Password is now optional and the .sth file will be used if present\n\n 3. Bug Fixes\n\n [HOR-841] - Fixed various defects linked to KDB storage:\n\n Chain missing in protocol enrollments\n\n .sth/.rdb files missing in protocol enrollments\n\n automate control issues when .sth/.rdb or chain files are missing\n\n [HOR-810] - Fixed a crash that could occur when using the Windows certificate store\n\n [HOR-806] - automate revoke : fixed an issue where revoking the certificate using ACME failed if its private key was stored in the Windows certificate store\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.15.0 release notes", + "content": "Horizon-cli 1.15.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.15.1, released on 2026-02-27.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-843] - KDB Password is now optional and the .sth file will be used if present\n\n 3. Bug Fixes\n\n [HOR-841] - Fixed various defects linked to KDB storage:\n\n Chain missing in protocol enrollments\n\n .sth/.rdb files missing in protocol enrollments\n\n automate control issues when .sth/.rdb or chain files are missing\n\n [HOR-810] - Fixed a crash that could occur when using the Windows certificate store\n\n [HOR-806] - automate revoke : fixed an issue where revoking the certificate using ACME failed if its private key was stored in the Windows certificate store\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n Defects in the chain order feature cause the chain to reset to root-to-leaf order after renewal. This may have a significant operational impact. This affects:\n\n Certificates under management prior to version 1.14.0\n\n Certificates controlled with the automate control command. Fixed in version 1.17.1\n\n The issue is currently being addressed, and a fixed version will be available soon.\n\n Automatic TLS Certificate Installation\n Horizon Cli 1.15.0 release notes", "keywords": [ "horizon-cli", "15", @@ -2392,7 +2392,7 @@ "Horizon-cli 1.16.0 release notes" ], "summary": "Horizon-cli 1.16.0 release notes Here are the release notes for EverTrust Horizon Client v1.16.0, released on 2026-04-13. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-9", - "content": "Horizon-cli 1.16.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.16.0, released on 2026-04-13.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-923] - All enrollment commands now support a --dn flag to specify the full Subject DN, enabling use of additional DN attributes such as DC.\n\n [HOR-939] - Ensured Windows Server 2025 support.\n\n [HOR-970] - Panorama discovery is now supported in the netimport section.\n\n [HOR-972] - Tenable.sc is now supported as a scan import source in the importscan section.\n\n [HOR-996] - A new --update flag is now available for protocol enrollment commands, allowing JKS and KDB keystores to be updated in place rather than overridden.\n\n [HOR-1019] - A new HRZ_LOCALDB environment variable is now supported to configure an alternative configuration directory.\n\n [HOR-1021] - A new horizon-cli automate edit command is now available to modify certificate options in the client internal state.\n\n [HOR-809] - A new --generic-windows-archival flag is now available on horizon-cli install to control whether outdated certificates are removed from the Windows store after renewal. This is to ensure compatibility with pre 1.11 versions.\n\n 2. Enhancements\n\n [HOR-1024] - horizon-cli automate list now displays certificates deleted outside the CLI as \"Could not retrieve\" instead of failing, and horizon-cli automate remove now supports removing such entries from state.\n\n [HOR-1140] - TLS ciphers reported by the NMAP ssl-enum-ciphers script are now parsed and displayed in Horizon scan results.\n\n [HOR-754] - IP SANs are now displayed alongside DNS SANs in horizon-cli automate list output.\n\n [HOR-78] - The --scan-tls flag is now available in netscan to test all TLS versions supported by an endpoint.\n\n 3. Bug Fixes\n\n [HOR-882] - Fixed an issue where EC certificates were not retrieved during an F5 netimport.\n\n [HOR-1017] - Fixed an issue where horizon-cli webra enroll returned unclear error messages when using a non-existent profile or a profile with a manual password policy.\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Horizon-cli 1.16.1 release notes", + "content": "Horizon-cli 1.16.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.16.0, released on 2026-04-13.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-923] - All enrollment commands now support a --dn flag to specify the full Subject DN, enabling use of additional DN attributes such as DC.\n\n [HOR-939] - Ensured Windows Server 2025 support.\n\n [HOR-970] - Panorama discovery is now supported in the netimport section.\n\n [HOR-972] - Tenable.sc is now supported as a scan import source in the importscan section.\n\n [HOR-996] - A new --update flag is now available for protocol enrollment commands, allowing JKS and KDB keystores to be updated in place rather than overridden.\n\n [HOR-1019] - A new HRZ_LOCALDB environment variable is now supported to configure an alternative configuration directory.\n\n [HOR-1021] - A new horizon-cli automate edit command is now available to modify certificate options in the client internal state.\n\n [HOR-809] - A new --generic-windows-archival flag is now available on horizon-cli install to control whether outdated certificates are removed from the Windows store after renewal. This is to ensure compatibility with pre 1.11 versions.\n\n 2. Enhancements\n\n [HOR-1024] - horizon-cli automate list now displays certificates deleted outside the CLI as \"Could not retrieve\" instead of failing, and horizon-cli automate remove now supports removing such entries from state.\n\n [HOR-1140] - TLS ciphers reported by the NMAP ssl-enum-ciphers script are now parsed and displayed in Horizon scan results.\n\n [HOR-754] - IP SANs are now displayed alongside DNS SANs in horizon-cli automate list output.\n\n [HOR-78] - The --scan-tls flag is now available in netscan to test all TLS versions supported by an endpoint.\n\n 3. Bug Fixes\n\n [HOR-882] - Fixed an issue where EC certificates were not retrieved during an F5 netimport.\n\n [HOR-1017] - Fixed an issue where horizon-cli webra enroll returned unclear error messages when using a non-existent profile or a profile with a manual password policy.\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n Defects in the chain order feature cause the chain to reset to root-to-leaf order after renewal. This may have a significant operational impact. This affects:\n\n Certificates under management prior to version 1.14.0\n\n Certificates controlled with the automate control command. Fixed in version 1.17.1\n\n The issue is currently being addressed, and a fixed version will be available soon.\n\n Horizon-cli 1.16.1 release notes", "keywords": [ "horizon-cli", "16", @@ -2421,7 +2421,7 @@ "Horizon-cli 1.16.1 release notes" ], "summary": "Horizon-cli 1.16.1 release notes Here are the release notes for EverTrust Horizon-cli v1.16.1, released on 2026-04-30. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2.", - "content": "Horizon-cli 1.16.1 release notes\n\n Here are the release notes for EverTrust Horizon-cli v1.16.1, released on 2026-04-30.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-1234] - Amazon Linux is now supported for TLS services base OS detection.\n\n 3. Bug Fixes\n\n [HOR-1232] - Fixed an issue where the DNS-01 script ACME solver could not be resolved when using DNS-01 validation.\n\n [HOR-1183] - Fixed an issue where the --pfx-strength help output for the init , control , and enroll commands incorrectly listed \"normal\" instead of \"average\" as a possible value.\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation\n Horizon-cli 1.16.0 release notes", + "content": "Horizon-cli 1.16.1 release notes\n\n Here are the release notes for EverTrust Horizon-cli v1.16.1, released on 2026-04-30.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-1234] - Amazon Linux is now supported for TLS services base OS detection.\n\n 3. Bug Fixes\n\n [HOR-1232] - Fixed an issue where the DNS-01 script ACME solver could not be resolved when using DNS-01 validation.\n\n [HOR-1183] - Fixed an issue where the --pfx-strength help output for the init , control , and enroll commands incorrectly listed \"normal\" instead of \"average\" as a possible value.\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n Defects in the chain order feature cause the chain to reset to root-to-leaf order after renewal. This may have a significant operational impact. This affects:\n\n Certificates under management prior to version 1.14.0\n\n Certificates controlled with the automate control command. Fixed in version 1.17.1\n\n The issue is currently being addressed, and a fixed version will be available soon.\n\n Automatic TLS Certificate Installation\n Horizon-cli 1.16.0 release notes", "keywords": [ "horizon-cli", "16", @@ -2701,7 +2701,32 @@ "Horizon-cli 1.17.0 release notes" ], "summary": "Horizon-cli 1.17.0 release notes Here are the release notes for EverTrust Horizon Client v1.17.0, released on 2026-06-19. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features The ne", - "content": "Horizon-cli 1.17.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.17.0, released on 2026-06-19.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n The netimport akv and netimport aws-acm commands now expose a --connector flag to attach the corresponding third-party connector metadata to discovered certificates, enabling renewals to update the existing AKV or ACM object instead of creating a new one\n\n ACME automation commands using DNS-01 challenges can now bypass the client-side authoritative name server propagation pre-check and tune the DNS-01 operation timing through the --dns-01-propagation-wait and --dns-01-timeout flags\n\n Automation commands can now set a dedicated password on the JKS alias entry using the --jks-alias-pwd option\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n Automation: Removed an erroneous backup log emitted during new enrollments on generic targets\n\n Localimport: Fixed an issue where certificates encoded as DER Hex strings could not be imported from CSV files\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation", + "content": "Horizon-cli 1.17.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.17.0, released on 2026-06-19.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n The netimport akv and netimport aws-acm commands now expose a --connector flag to attach the corresponding third-party connector metadata to discovered certificates, enabling renewals to update the existing AKV or ACM object instead of creating a new one\n\n ACME automation commands using DNS-01 challenges can now bypass the client-side authoritative name server propagation pre-check and tune the DNS-01 operation timing through the --dns-01-propagation-wait and --dns-01-timeout flags\n\n Automation commands can now set a dedicated password on the JKS alias entry using the --jks-alias-pwd option\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n Automation: Removed an erroneous backup log emitted during new enrollments on generic targets\n\n Localimport: Fixed an issue where certificates encoded as DER Hex strings could not be imported from CSV files\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n Defects in the chain order feature cause the chain to reset to root-to-leaf order after renewal. This may have a significant operational impact. This affects:\n\n Certificates under management prior to version 1.14.0\n\n Certificates controlled with the automate control command. Fixed in version 1.17.1\n\n The issue is currently being addressed, and a fixed version will be available soon.\n\n Automatic TLS Certificate Installation", + "keywords": [ + "horizon-cli", + "17", + "release", + "notes", + "release-notes", + "release-notes/1", + "horizon", + "client" + ] + }, + { + "page_id": "horizon-cli:1.17:release-notes:1.17.1", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.17", + "title": "Horizon-cli 1.17.1 release notes", + "section": "release-notes", + "slug": "release-notes/1.17.1", + "url": "https://docs.evertrust.fr/horizon-cli/1.17/release-notes/1.17.1.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.17/release-notes/1.17.1.html", + "breadcrumbs": ["Horizon Client", "Horizon-cli 1.17.1 release notes"], + "summary": "Horizon-cli 1.17.1 release notes Here are the release notes for EverTrust Horizon Client v1.17.1, released on 2026-07-02. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None]", + "content": "Horizon-cli 1.17.1 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.17.1, released on 2026-07-02.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n Automation (control): controlled certificates now keep the proper chain order on renewal\n\n Automation (apache): certificates in a virtual host with SSLEngine enabled are now properly detected regardless of the SSLEngine directive value\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n Defects in the chain order feature cause the chain to reset to root-to-leaf order after renewal. This may have a significant operational impact. This affects:\n\n Certificates under management prior to version 1.14.0\n\n The issue is currently being addressed, and a fixed version will be available soon.", "keywords": [ "horizon-cli", "17", diff --git a/src/generated/docs/doc-versions.json b/src/generated/docs/doc-versions.json index 94c907f..d420e61 100644 --- a/src/generated/docs/doc-versions.json +++ b/src/generated/docs/doc-versions.json @@ -1,5 +1,5 @@ { - "generatedAt": "2026-07-01T08:12:21.623Z", + "generatedAt": "2026-07-02T11:07:04.989Z", "products": { "horizon": { "product": "horizon", diff --git a/src/generated/docs/product-doc-pages.json b/src/generated/docs/product-doc-pages.json index a769474..b5a1918 100644 --- a/src/generated/docs/product-doc-pages.json +++ b/src/generated/docs/product-doc-pages.json @@ -1,5 +1,5 @@ { - "generatedAt": "2026-07-01T08:11:06.995Z", + "generatedAt": "2026-07-02T11:05:54.440Z", "pageCount": 1006, "pages": [ { From 91900218d5208e41485a4e4c5b27de8221fa85f8 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 2 Jul 2026 13:15:00 +0200 Subject: [PATCH 10/12] test: bump scenario smoke tool count for read_knowledge --- tests/llm-evaluation/smoke.test.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/llm-evaluation/smoke.test.ts b/tests/llm-evaluation/smoke.test.ts index 4e4cfd3..07a8494 100644 --- a/tests/llm-evaluation/smoke.test.ts +++ b/tests/llm-evaluation/smoke.test.ts @@ -6,8 +6,8 @@ describe('Provider-agnostic scenario smoke tests', () => { it('loads tool and resource metadata without external model dependencies', async () => { const metadata = await loadScenarioMetadata(); - // 85 base tools + 126 configuration CRUD tools (src/tools/config). - expect(metadata.tools.length).toBe(211); + // 86 base tools + 126 configuration CRUD tools (src/tools/config). + expect(metadata.tools.length).toBe(212); expect(metadata.resources.length).toBeGreaterThan(20); }); From 2d91f413ccbd216536cc941e3770b3ec90cf3328 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 2 Jul 2026 13:21:50 +0200 Subject: [PATCH 11/12] docs: bump tool counts to 212 and document read_knowledge --- README.md | 8 ++++---- docs/client-setup.md | 4 ++-- docs/tools-reference.md | 7 ++++--- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 9d76c7c..474ed60 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ Most MCP servers hand an LLM a list of tools and leave it to figure out the doma ## Features -- **211 tools across 12 domains**, each annotated with a safety tier (`read-only`, `mutating-safe`, `mutating-destructive`). +- **212 tools across 12 domains**, each annotated with a safety tier (`read-only`, `mutating-safe`, `mutating-destructive`). - **Knowledge catalog**: 17 core topic URIs, 4 curated playbooks, plus auto-generated section URIs derived from H2 headings of the longest guides. - **Two credential types**: Horizon API key (`X-API-ID` / `X-API-KEY`) and TLS client certificate (PEM or PKCS12/PFX). Usable as a single server identity, or per caller over the HTTP transport. - **HQL helpers**: validators and natural-language translators for HCQL (certificates), HRQL (requests), HEQL (events), and HDQL (discovery events). @@ -34,7 +34,7 @@ Tool counts per domain: | Discovery feed | 4 | push-mode certificate and event ingestion | | Discovery events | 3 | search, fetch, CSV export | | Reports | 3 | list, download, delete | -| Docs | 3 | search product docs, search API docs, fetch a page | +| Docs | 4 | search product docs, search API docs, fetch a page, read knowledge | | Profiles | 2 | list and inspect (CRUD lives in the Horizon admin UI) | Full per-tool table with safety tiers in [docs/tools-reference.md](docs/tools-reference.md). @@ -239,7 +239,7 @@ See [docs/authentication.md](docs/authentication.md) for the full step-by-step g ## Tool catalog overview -The 211 tools are grouped into 12 domains. Each tool ships with explicit "use when / do not use when" guidance for smaller models. The table at the top of this README lists tool counts; [docs/tools-reference.md](docs/tools-reference.md) has the full per-tool table with safety tiers and one-line descriptions. +The 212 tools are grouped into 12 domains. Each tool ships with explicit "use when / do not use when" guidance for smaller models. The table at the top of this README lists tool counts; [docs/tools-reference.md](docs/tools-reference.md) has the full per-tool table with safety tiers and one-line descriptions. Knowledge resources are exposed at `horizon://knowledge/*` URIs. See [docs/knowledge-resources.md](docs/knowledge-resources.md) for the full catalog. @@ -442,7 +442,7 @@ PRs welcome. Before opening a pull request, run `bun run validate:ci` (it runs f | [Installation](docs/installation.md) | Install methods and troubleshooting | | [Authentication](docs/authentication.md) | Supported credential types with environment variable reference | | [Client setup](docs/client-setup.md) | Claude Desktop, Claude Code, Cursor, Codex, OpenCode, MCP Inspector | -| [Tool reference](docs/tools-reference.md) | All 211 tools by domain with safety tiers | +| [Tool reference](docs/tools-reference.md) | All 212 tools by domain with safety tiers | | [Knowledge resources](docs/knowledge-resources.md)| 17 core URIs, 4 curated playbooks, generated section resources | | [Development](docs/development.md) | Dev setup, tests, linting | diff --git a/docs/client-setup.md b/docs/client-setup.md index d4785c1..57392b8 100644 --- a/docs/client-setup.md +++ b/docs/client-setup.md @@ -78,7 +78,7 @@ Or with the standalone binary: } ``` -Start Claude Code from that directory. The 211 tools are available immediately. +Start Claude Code from that directory. The 212 tools are available immediately. ## Cursor @@ -218,7 +218,7 @@ export HORIZON_API_KEY=your-api-key bunx @modelcontextprotocol/inspector bunx @evertrust/horizon-mcp ``` -Opens a browser UI showing all 211 tools and the full knowledge resource catalog (17 core URIs + 4 curated playbooks + generated section URIs). +Opens a browser UI showing all 212 tools and the full knowledge resource catalog (17 core URIs + 4 curated playbooks + generated section URIs). ## Connecting over streamable HTTP (remote server) diff --git a/docs/tools-reference.md b/docs/tools-reference.md index bd896dc..4ce8172 100644 --- a/docs/tools-reference.md +++ b/docs/tools-reference.md @@ -1,6 +1,6 @@ # Tool reference -211 tools across 12 domains (incl. 126 Configuration CRUD tools). Safety tiers: +212 tools across 12 domains (incl. 126 Configuration CRUD tools). Safety tiers: - **read-only** - no side effects - **mutating-safe** - creates or modifies data, safe to retry @@ -38,13 +38,14 @@ All `delete_*` and `flush_*` tools require an `expected_name` (or `expected_iden | `simulate_datasource_flow` | read-only | Test a datasource flow pipeline and translate MCP input to Horizon dsFlow payloads | | `convert_pkcs12_to_jks` | read-only | Convert PKCS#12 to JKS keystore | -## Docs (3 tools) +## Docs (4 tools) | Tool | Safety | Description | |------|--------|-------------| | `search_docs` | read-only | Search official product documentation; use this first, then `get_doc_page` | | `search_api_docs` | read-only | Search official Horizon API reference pages; use this first, then `get_doc_page` | -| `get_doc_page` | read-only | Fetch the full indexed content for a page returned by a docs-search tool | +| `get_doc_page` | read-only | Fetch the indexed content for a page returned by a docs-search tool (windowed via `max_chars`/`offset`) | +| `read_knowledge` | read-only | Read an embedded `horizon://knowledge/*` topic as a tool, for clients without MCP resource support | ## Lifecycle (17 tools) From 037c99120c7c8f15728ecbc6e525631a74e78084 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 2 Jul 2026 13:35:18 +0200 Subject: [PATCH 12/12] docs: add toolset gating guide, read_knowledge access path, CI gates reference --- docs/client-setup.md | 26 ++++++++++++++++++++++++++ docs/development.md | 21 +++++++++++++++++++++ docs/knowledge-resources.md | 2 ++ 3 files changed, 49 insertions(+) diff --git a/docs/client-setup.md b/docs/client-setup.md index 57392b8..7658738 100644 --- a/docs/client-setup.md +++ b/docs/client-setup.md @@ -2,6 +2,32 @@ Configure your LLM client to connect to the horizon-mcp server. +## Trimming the tool surface (recommended) + +The full server registers 212 tools, which costs roughly 45-55k context +tokens per session before the first user message. If you do not need every +domain, scope the server with two environment variables (they work in any +client's `env` block below, and server-side in HTTP mode): + +- `HORIZON_ENABLED_TOOLSETS` - comma-separated list of domains to register. + Valid names: `lifecycle`, `profiles`, `dashboards`, `discovery`, + `datasources`, `reports`, `triggers`, `docs`, `assist`, `config`. + Unknown names fail at startup with the valid list. +- `HORIZON_READ_ONLY=true` - drop every mutating tool (create/update/delete, + request submission), keeping only read-only tools. + +Suggested presets: + +| Use case | Setting | +| -------- | ------- | +| Certificate operations (search, enroll, revoke, decode) | `HORIZON_ENABLED_TOOLSETS=lifecycle,assist,docs` | +| Read-only auditing and reporting | `HORIZON_READ_ONLY=true` (optionally add a toolset list) | +| Configuration administration | `HORIZON_ENABLED_TOOLSETS=config,assist,docs` | +| Discovery review | `HORIZON_ENABLED_TOOLSETS=discovery,lifecycle,assist` | + +A scoped lifecycle+docs+assist read-only server registers ~38 tools instead +of 212, cutting the context cost by roughly 80%. + ## Claude Desktop Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows): diff --git a/docs/development.md b/docs/development.md index d59b90f..2ceba6f 100644 --- a/docs/development.md +++ b/docs/development.md @@ -6,6 +6,27 @@ bun install ``` +## CI gates + +Every PR runs the checks below (plus commitlint on the commit range - one-liner +`type: description` messages, header under 100 chars). Run the full sequence +locally before pushing: + +```bash +bun run validate:ci +``` + +| Gate | Command | Notes | +| ---- | ------- | ----- | +| Formatting | `bun run format:check` | Prettier over `src/` and `tests/` (includes markdown under `tests/`) | +| Lint | `bun run lint` | ESLint + `tsc --noEmit` | +| Typecheck | `bun run typecheck` | `tsc --noEmit` only | +| Build | `bun run build` | tsup production build | +| API truth | `bun run verify:truth` | Checks documented API claims against the recorded truth set | +| Docs inventory | `bun run docs:diff` | Fails when docs.evertrust.fr drifted; fix with `bun run docs:refresh` and commit the regenerated `src/generated/docs/*.json` | +| Unit tests | `bun run test` | Includes golden snapshots of all tool schemas - adding or changing a tool requires updating `tests/unit/golden.test.ts` (tool count, `EXPECTED_TOOL_NAMES`, snapshot) | +| Scenario suite | `bun run test:scenarios` | Deterministic tool-selection scenarios; `tests/llm-evaluation/smoke.test.ts` asserts the exact total tool count | + ## Unit tests ```bash diff --git a/docs/knowledge-resources.md b/docs/knowledge-resources.md index 96c9504..9c2ff5b 100644 --- a/docs/knowledge-resources.md +++ b/docs/knowledge-resources.md @@ -8,6 +8,8 @@ The server exposes a generated knowledge catalog at `horizon://knowledge/*`: MCP clients can read these resources to ground tool choice and payload construction, but the server does not guarantee that every client will preload them before issuing tool calls. +For clients with weak or missing MCP resource support, the same content is reachable through the `read_knowledge` tool (in the `docs` toolset): pass a `topic` slug (for example `query-languages`) and optionally a `section`, and page through long guides with `max_chars` / `offset`. Tool descriptions that reference `horizon://knowledge/*` URIs can always be resolved this way. + | Resource | URI | Contents | |----------|-----|----------| | Profiles | `horizon://knowledge/profiles` | Module types, field reference, authorization modes |